Telefónica Tech’s digital forensic blueprint offers forces the right tech in the right place, for the right reasons

For anyone in UK policing with a focus on digital forensics, December’s report by HM Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) made for quite gloomy reading.

“Slow, ineffective” digital forensics examination, which in places was “so egregious that victims were being failed”; a service behind the curve and failing to get to grips with a huge and growing backlog; and a “gulf in performance” between forces, were just some of the issues highlighted by the Inspectorate.

Those concerns are unlikely to have been a surprise to many working in the sector; and for leading police technology supplier Telefónica Tech, the challenges identified in the report further underlined the value and benefits of the company’s ‘blueprint’ approach to delivering digital forensics for forces.

The blueprint offers forces a flexible, ‘start to finish’ digital forensics framework that addresses those challenges across the process – from capturing and ingesting the digital evidence, through to evidential analysis, case building and submission, and on to the review, retention and deletion of data and MOPI requirements.

Those technical advances also translate into personal and practical benefits – including the faster conviction of criminals, a much-improved service both for police officers, investigators and the victims of crime, and predictable long-term cost and outcomes.

“The idea of the blueprint is to have everything that a digital forensics unit could need,” explains Will Wilkinson, Solutions Architect with Telefónica Tech. “It’s almost like digital forensics as a service; you could just lift it up and drop it in, you have all the bits you need to get going without dealing with multiple suppliers, and you don’t need to make sure it all integrates and sticks together nicely – it’s there and ready to go.

“It’s not rigid in that you have to buy a specific server, application or cloud provider. It’s got flexibility so that if forces have preferred vendors in any of those areas, we can easily swap one out for another. So it’s not a fixed design, it’s a start point and you can work from there – that’s one of the real values I think of the blueprint.”

Enterprise-grade solutions

Having worked with police forces in the UK and internationally for many years, the Telefónica Tech team are well aware of some of the technology difficulties within the sector; so how can the blueprint help to solve those issues in the digital forensics processes, particularly the storage concerns highlighted by the HMICFRS and others?

“Looking at the challenges in order, I think in terms of getting investigations started quicker, many police forces – depending on where they are in terms of technological maturity – are often working off workstations and USB hard drives,” continued Will.

“So they’re ingesting an image from a phone, and putting it onto a USB hard drive which inherently isn’t particularly high performing or secure. What we’re trying to do is give them more of an enterprise-grade IT solution – fast, shared storage that can handle lots of data being thrown at it very quickly.

“That enables lots of staff or officers to capture images of mobile phones and tablets, and get that into a shared storage pool as quickly as possible.

“When we’re looking at processing and analysing data, again it’s about giving forces more of an enterprise-grade server infrastructure with the necessary capabilities and characteristics that can enable them to analyse that data more quickly and efficiently – for example, by using GPUs to offload the performance from the CPU.”

Another advantage of this faster, more effective approach is its accessibility, allowing staff and officers to visualise the digital evidence more quickly: “The review platform means police officers can log in from wherever they are – in the office, working from home or out on an incident – and through a URL start to see that digital evidence data such as pictures, videos, text messages etc, which again means they can start to process cases faster,” said Will.

“So those are three key areas – ingesting the data, the compute performance and the application to enable them to get access to all those things anytime, from anywhere – where the blueprint can deliver obvious benefits.”

Perfect storm

While introducing this technology enables officers and staff to address the current issues highlighted by the report, the team also recognises that individual forces may be at different stages of their own digital forensics development, so the flexibility of the blueprint will be crucial to allowing forces to ‘mix and match’ the solutions that meet their own priorities.

And with the criminal use of technology only likely to expand further, future proofing the approach will be essential if forces are to extract the greatest possible value.

“From what we’ve seen, I think a lot of forces seem to be in a kind of second cycle,” explained Will. “They were probably strong in digital forensics and doing some advanced stuff four or five years ago, but now they’re almost behind the curve again and they’ve got such a large backlog of cases that it hasn’t allowed them to transform.

“For example, we know of forces where digital forensic data is held on the general purpose data storage, which isn’t ideal for anyone because it’s the type of data that they don’t want on that storage, and it’s also consuming a lot of storage from the wider force network.

“So getting that sheer volume of data captured, ingested and analysed quickly and efficiently now seems to be the number one driver.”

“And the volume challenge is only going to get more difficult,” continued Ed Taylor, Telefónica Tech’s Strategic Account Director. “We now estimate that  around 90% of all crime has a digital footprint. The majority of criminals have three, four, even five mobile phones, as well as other digital devices.

“That’s then coupled with the latest technology from the phone manufacturers – terabyte phones are now commonplace. So both the criminal use of technology, and the amount of images and data that are stored on these devices, is exploding.

“At the same time, the police are under pressure to get digital devices back to people – particularly victims of crime – as quickly as possible, a process that in the past might have taken several months.

“It’s now more widely understood that those people who are victims may well utilise their phone for their support mechanism. So the whole thing is coming rapidly to a head; the volume and complexity of the threat landscape has gone up, the pace on often ageing systems is declining, and with the real problem of caseload management and providing effective victim support, you’ve got a perfect storm.”

Right tech, right place, right reasons

Despite those multiple pressures, Will is quick to emphasise that Telefónica Tech’s blueprint offering doesn’t mean that forces need to take everything, all at once. “It’s not a case of being prescriptive to forces and saying, you need to take all of this,” explained Will. “In fact, depending on where a force is in its development cycle, typically we would say, ‘Don’t go big bang – you probably want a roadmap of things you want to solve first’.

“If they’ve got a lot of infrastructure in place and actually what they need is just really big, really fast storage, or a computer to help them do that, or some backup or replication data storage, then we can provide the solutions to that piece of the challenge. It’s kind of like an a la carte menu.” And when you look at what vendors are offering now, for example HPE’s GreenLake consumption-based approach, it helps remove financial barriers and minimise risk to technological advancement.

Those solutions are also very much tailored to the needs of the force – whether that means swapping a particular piece of the technology because the force has a preference or productive relationship with a particular vendor, or finding the most appropriate hybrid combination of public cloud and on-premises storage to meet the force’s specific requirements.

“Certainly, my mantra is about putting the right tech in the right place for the right reasons,” added Will.

 “Just to give you some snapshots of the work we’re doing, we’re currently working with a force where, on average, the waiting time to start to process a laptop can be 60 days or more, with mobile phones it’s longer” said Ed. “Once we’ve finished the transformation work, we’re looking to get that down to below 20 hours.

“We’re also starting to engage with the regional organised crime units (ROCUs), many of which have digital forensics units within them, or closely linked to them. The ROCUs know that if they are investigating a criminal in one area, they may need to be able to work out what their footprint is across multiple locations, so speed and collaboration are key.

“But each of those digital forensics units may well be working with slightly different tech, so we’re now using the blueprint approach to work with them and look at what’s fit for purpose, what can be repurposed, and where do we need to help them make the changes.”

There’s no doubt that the HMICFRS report highlighted significant challenges for policing across the digital forensics workstream, many of which were recognised (although often not addressed) by forces themselves.

But it’s equally clear that the innovative and effective blueprint approach pioneered by Telefónica Tech offers real workable solutions to many of those challenges, and can deliver beneficial outcomes both for policing and for victims of crime.