Three views on cell phone forensic extraction tools

As part of the research for the second part of our study ¿Quién revisa tu teléfono? (Who searches your phone?), published by the Association for Civil Rights (ADC), we invited three experts in law and technology to share their views on the current state of affairs with respect to mobile forensic extraction tools.

In criminal proceedings and investigations, these devices are being applied to collect digital evidence from cell phones. This practice is not free from the risks posed by the conflict between accessing personal information, on the one hand, and the respect for due process, on the other.

In order to hear different perspectives of the issue, we talked to Gustavo Aboso, Buenos Aires City official counsel for the defense in Criminal, Contraventional and Misdemeanors; Matías Werner, a lawyer specialized in Cybercrime and Digital Evidence; and Javier Bura Peralta, lawyer, digital forensic researcher in the Latin American Network of Computer Forensics and head of the Forensic Research Area of the Argentinian Institute of Computer Procedural Law (IADPI).

Lawlessness and ignorance

From his role in the Buenos Aires Judiciary, public defender Gustavo Aboso referred to the state of Argentinian regulations on criminal procedure in the digital sphere in terms of constitutional guarantees. “The main problem is the legal vacuum, because in general, there are no provisions regulating the collection of data, in addition to the lack of information on the use of programs or algorithms that limit the search for data to the object of the investigation,” he said.

Likewise, regarding the inconveniences that emerge from using these forensic technologies in criminal procedures, Aboso stated that, “in general, there is gross ignorance, because only recently has the appropriateness of seizing electronic devices, extracting their information and applying computer forensics come into question Unlike public prosecution offices, which are furnished with a specialized unit, there is no such thing in the office for the public defense.”

Given the complexity of the matter, both in terms of technology and law, judicial operators have a reasonable degree of knowledge of the different problems observed in using the mentioned forensics tools. In this regard, Aboso pointed out that “a special regulation should be envisaged, in which the type of crime is considered.”

In addition, the attorney enhanced the need for approval of the software used by an authority with control of the parties. “Search time is an issue to be considered. Today an investigation depends on whatever program the agency has managed to procure,” concluded Aboso.

More training

Based on his experience as an expert in cybersecurity and editor of a specialized journal, Matías Werner referred to the regulatory situation in the country, where several provinces have added provisions on digital evidence to their procedural law. “Some are more precise while others have a rather broad wording, because they provide the tools but create other problems, and that is where I believe the conflict with the protection of constitutional guarantees occurs,” he appraised.

Due to this, Werner proposed the enactment of a specific norm on digital evidence in criminal proceedings, as “a pending debt at the federal level”.

As to the data extraction technology, the expert considered that so far, most of the issues “revolved more around the admissibility criteria of the evidence than the extraction itself.”

Among other aspects, Werner pointed out that information stored in devices is becoming increasingly more voluminous. This gives rise to the implementation of “search criteria”, such as the use of keywords, to delimit the scope of the investigation. He also pondered the suitability of the “incidental findings” doctrine, i.e., the appearance of evidence related to a crime other than the one being investigated.

Regarding the degree of awareness of these problems among judicial operators, Werner considered that despite their increasing acquaintance with forensic extraction tools, there is still a need for further training.

Finally, he shared three recommendations for better use of these technologies within the framework of due process:

• Courts, prosecutors, public defenders, and law firms must form teams with greater interdisciplinarity.
• Judicial staff profiles should add technical abilities linked to information systems and forensics to the specifically legal ones.
• Legal professionals should receive more training on how data extraction tools work.

Inadequate software

For computer forensics investigator Javier Bura Peralta, Argentinian laws on criminal procedure in the digital sphere vary according to each jurisdiction. “Many procedural codes have little or no regulation regarding the protection of constitutional guarantees in the digital sphere,” he said. “While others, such as the one of Río Negro, are much more detailed when it comes to adequately balance the preservation of digital evidence and the respect for rights.”

“What is constantly seen, concerning the technologies in hands of the authorities, is that the software is inadequate, often outdated, or with expired licenses,” revealed Bura Peralta.

The researcher also considered that “there is little or no knowledge of these problems among judicial staff. Only operators working for the different security forces have sufficient training, depending on the budget of each province.”

“We have a long way to go, including jurisprudential debates, to achieve a complete understanding of the existence, respect and implementation of the specific provisions by absolutely all judicial operators,” he stressed.

As a proposal for better use of extraction tools within the respect for due process, Bura Peralta enhanced the need for a “continuous, appropriate and professional” training.