Cyber Forensic Investigators Training - 185/20

Date Responded 18 February 2020

Provision of information held by Northumbria Police made under the Freedom of Information Act 2000 (the 'Act')

As you may be aware the purpose of the Act is to allow a general right of access to information held at the time of a request, by a Public Authority (including the Police), subject to certain limitations and exemptions.

You asked:

  1. What training schemes and/or organisations do you use to train your cyber forensic investigators?
  2. Do you conduct in house training (e.g. all training is produced within your organisation)?
  3. If you use in house training, how do you create your training datasets?
  4. If you create your own datasets, who does this and how long does it usually take that person to create the datasets?

On 29 January 2020 you clarified point 1 as referring to Digital Forensic Investigators.

In Response:

Following receipt of your request, searches were conducted with the Training Department of Northumbria Police.  I can confirm that the information you have requested is held, in part, by Northumbria Police.

I am able to disclose the located information to you as follows.

  1. We will not be disclosing the information requested at this point of your request and will rely on the following exemption:

Section 31 (1) (a) Law Enforcement

As this is a qualified, prejudiced based exemption I must evidence the harm and conduct a Public Interest Test (PIT).  I have set these out below.

Evidence of Harm

Modern day policing is intelligence led and law enforcement depends upon the development of intelligence and the gathering and security of evidence in order to disrupt criminal behaviour and bring offenders to justice.  As criminals adapt and exploit new technology, the police need to respond by overcoming hi-tech barriers in order to meet their responsibilities. 

Disclosing “training schemes and/or organisations you use to train your cyber forensic investigators.” would give perpetrators the opportunity to explore police forensic training schemes and training delivery organisations in order to find out how the police look for and extract forensic information giving criminals the ability to use countermeasures in order to avoid detection.  This would undermine the process of preventing or detecting crime and the apprehension of prosecution of offenders.

Public Interest Test

Factors favouring Disclosure

Disclosure of the requested information would raise the general public’s awareness that the police are effectively training cyber forensic investigators and appropriately investigating and extracting digital information from various devices and systems, enhancing Northumbria Polices’ ability to deliver effective operational law enforcement.

Factors favouring Non-Disclosure

The current and future law enforcement role of Northumbria Police may be compromised by the release of such information therefore having a negative impact on the effectiveness of the force.

In this case, for the reasons outlined in the evidence of harm above, the effectiveness of current and future strategies when carrying out investigations and gathering evidence may be compromised.

The personal safety of individuals and the general public is of paramount importance to the Police Service and must be considered in response of every release.  A disclosure under Freedom of Information is a release to the world and, in this case, disclosing tactical information relating to the extraction of data from digital devices would undermine the evidence gathering process of any investigative inquiry relating to offences, some of which may be serious cases such as murder or rape.

Balancing Test

As always the Freedom of Information Act has a presumption of disclosure, unless when balancing the competing public interest factors prejudice to the community outweighs the benefits.  In this case, there is an argument for disclosure, inasmuch as the public have a right to know that every effort is made to gather all relevant evidence, including extracting data from digital devices, but this must be balanced against the negative impact these disclosures can have.  

Law Enforcement is reliant on community engagement, intelligence and evidence gathering and when it is appropriate, information is given to the public.  What has been established in this case is the fact that disclosure of information relating to technologies used when extracting data would have an adverse effect on the investigative process and on the prevention or detection of crime and the apprehension or prosecution of offenders.  This places the victims of such offending at a greater risk towards their health and wellbeing and is not an action the Police Service would be willing to take.  Clearly these negatives outweigh any tangible community benefit and therefore the balance does not favour disclosure at this time.

2. Yes 

3. The training datasets that are used within the Digital Forensic Unit is a hybrid of data received as part of approved national proficiency testing and in-house generated datasets as a result of research.

4. The creation of datasets is a task that is given to investigators that have been identified as possessing the experience, relevant knowledge and recording detail that is required to enable these datasets to be valuable assets for other investigators.  With the introduction of ISO17025 laboratory accreditation this is often carried out by the unit’s Technical Manager or authorised deputy.  No information held with regards to the time taken to create datasets, however this is time consuming and difficult to quantify and can be considered as a number of days.



back to top