When carrying out an “ordinary” crime, such as a break-in or a murder, the criminals leave evidence – such as traces of blood, DNA and fingerprints – at the scene. But people who commit crimes also leave behind digital traces, which make for another kind of fingerprint. This is where digital forensics comes in. Photo credit Annica Hesser
“There’s an unbelievable amount of digital evidence, such as from phones, which we carry with us everywhere. Our phone can reveal our movements and convey other kinds of information, such as pictures, positions and messages”, says Lena Klasén, research director at the Swedish Police Authority and adjunct professor at LiU.
Digital forensics is about searching after traces that can be connected to crimes, and turning them into relevant evidence during a trial. But it is also about investigating crimes with the help of advanced technology, for example by processing and analysing large amounts of data, detecting wanted individuals in CCTV footage, making 3D models of crime scenes etc.
“Digital forensics also includes the part of cyber security that is about preventing and discovering cyber attacks”, says Lena Klasén.
She has previously been head of the Swedish National Forensic Centre (NFC), and discovered during her time there the great need for digital forensics. Today, she runs several police projects related to AI. She is also one of the people behind the network Digital Forensics Sweden (DFCC), which is working to start a national, digital forensics research centre in Linköping. The goal is to gather together all of Sweden’s digital forensics expertise under one roof, and carry out world-class research. Another of their goals is to establish university programmes in digital forensics. LiU has concrete plans to have done this already by 2023.
We need to inject research, and above all AI expertise, into the police force.
“We need to inject research, and above all AI expertise, into the police force. When I worked at the NFC, I quickly realised that it was a huge area. It’s hard to keep up with technological development and have the right expertise. So people need to align themselves with those who have experience and the right knowledge."
This was how the first steps were taken towards the DFCC network in 2018. Today, the network has grown and consists of some 30 partners, including several universities (among them LiU), several companies, and various public authorities within both the Swedish legal and civil contingencies systems.
Past experiences highlight needs
In 2021, the DFCC carried out a research study which showed that there is great demand for everything from digital forensic skills, digital tools and programmes to increased collaboration between various actors.
The global uncertainty which has, as a result of the war in Ukraine, arisen in 2022 has also contributed to increasing focus on the need for IT forensic scientists. And not just because experts have warned of an increased cyber attack threat.
“Several war crime investigations have been opened in Europe, and the investigators are going to receive incredible amounts information, such as heterogeneous information, pictures, videos, text, media reports and more. And they need to try and conclude what is true and what is not, and who did what”, says Lena Klasén.
When AI is misused
Criminals have also discovered the usefulness of AI, not least of all for distorting reality. This is according to Niclas Fock, adjunct lecturer at the Department of Electrical Engineering (ISY) at LiU. Photo credit Annica Hesser
“Using today’s AI, you can in principle create material which looks truly realistic.”
He spends the vast majority of his time at the newly started Santa Anna IT Research Institute, which is connected to a project at the Department of Computer and Information Science at LiU. He works mostly with the initiative AI Sweden, Sweden’s national centre for AI. Among other things, the centre works with a talent programme to attract expertise to Sweden. He is also active in the DFCC network, and relates how the pre-study that was carried out in 2021 also revealed a great need to revise laws and frameworks in Sweden if digital forensics is to reach its full potential.
“In Sweden, public authorities are not allowed to tell each other which tools they have procured for, for example, scanning the internet and finding criminality. This is a big problem. We also have to take account of GDPR, and a new EU directive on AI.”
Can share methods
“But there are other solutions”, says Lena Klasén. In some projects, public authorities are able to bring in digital forensics-related AI technology, such as federated learning.
“When we can’t share information, we can at least share methods. Federated learning is not about sharing data. Instead, you break it up, share algorithms, and put the result together. AI also plays a big role in image analysis, which we used in the 3D model made by police after the terror attack on Drottninggatan in Stockholm”, she says.
The film, produced with the help of laser technology, shows how the perpetrator drove the lorry down the pedestrianised street before crashing into a shop.
“The film shows the course of events in less than a minute, something which would have taken several thousand pages to describe in a preliminary investigation report. The film turned out to be very useful, both in giving a picture of what happened and in helping relatives to understand it”, says Lena Klasén.
Technology helped identify the perpetrator
AI can also be used for biometrics at crime scenes, through technology which can automatically identify physical individuals. The technology was used to hunt down the perpetrator of the Drottninggatan attack by searching through pictures from the subway. Machine learning and deep learning are also useful AI technologies when looking for something specific – such as clothing or shoe colour – in large amounts of information.
“Another method we’re looking at involves using drones to document and map a crime scene. There’s always a risk of contamination when the first responders come to the scene”, says Lena Klasén.
Right now there are proposals and concrete plans for a master’s programme in cyber security, which will probably start in 2023.
Academic education
DFCC is also working on university courses that will help make Sweden leading in digital forensics. “The expertise, technology and research which we require are all areas of strength for Linköping University, says Jan-Åke Larsson, head of department at ISY. Photo credit Annica Hesser
“We have several research groups working in this area, both at ISY and the Department of Computer and Information Science. We also do the image analysis – that is to say, computer vision – component. Right now there are proposals and concrete plans for a master’s programme in cyber security, which will probably start in 2023. There is a suggestion for a course in digital forensics during the second year of the programme. We also have a very popular course in cyber security. Now we just need to get the programmes started and researchers in place.”
“We have got off to a good start with the adjunct positions that Lena and Niclas have, and we have also got two PhD students working with Lena”, says Jan-Åke Larsson, and adds that he sees an opportunity to offer commissioned education to external partners.
Below you can se the film, produced with the help of 3D technology, that shows how the perpetrator drove the lorry on Drottninggatan i Stockholm. (Video: NFC)
