The Importance of Proportionality in Digital Forensic Investigations

Through a commercial common sense based desire to restrict the scope of a digital forensic investigation in order to ensure a cost effective service is delivered, many investigators will automatically consciously deduce the key search terms and investigative angles within an investigation in order to get the job done effectively. However, alongside such deterministic duties, proportionality should always be at the back of an investigator’s mind from the outset of an investigation. Not only in avoidance of the cost implications regarding scope creep but to ensure investigations comply with the law.

Proportionality is a key term in digital forensic investigations.  Not only in a criminal law context but civil and commercial investigations where data protection laws and the Human Rights Act (1998) may impact the investigation.

So, what is proportionality?

Proportionality by its definition is self explanatory.  In the sense of a digital investigation, performing a proportionality test involves assessing the investigatory requirements in respect of the particular case detail/allegation whilst considering both the legal and ethical implications in respect of the scope of data to be investigated.

For example, imagine an ex-employee is alleged to have copied confidential company data using a company owned laptop they were allowed to keep at home and use for personal use. Would it be proportional for an investigator to browse through the picture gallery on the laptop containing family pictures?  Where Article 8 of the Human Rights Act determines that everyone has the right to respect for his private and family life, his home and his correspondence, would it be proportional for the investigator to view personal information such as salary slips and personal banking details sitting on the desktop of the suspect device?

Proportionality can be tricky to determine in respect of digital investigations. Whilst it may seem obvious to restrict the scope of the investigation towards media that is inline with the alleged wrongdoing (i.e., searching through word processing files within which copied confidential business data is suspected  to be located, or image galleries where indecent material is suspected to be located etc.) it can also be hugely detrimental for the investigator to be too cautious in their proportionality assessment.

Often, wrong do-ers who know their actions are illegal or in breach of company policy attempt to cover their tracks, therefore it is often necessary to consider items within the wider data set that may potentially contain evidence of wrongdoing.  Often evidence of misconduct can be obscured by a variety of means, therefore, proportionality tests can become difficult to perform without potentially missing crucial evidence disguised as innocuous material.   

So what’s the rule for determining proportionality?

In short, there is no specific rule.  Each proportionality assessment is relative to the investigation needs and data provided to be investigated.

In our next article, we will discuss the methods and techniques that exist for ensuring proportionality assessments don’t restrict the requirements of the investigation whilst also adhering to Data Protection laws.