Evaluation of forensic computer and technical expertise in criminal proceedings

The authorized parties to criminal proceedings (investigator, prosecutor, investigating judge, court) analyze the evidence from the standpoint of the objective review; check the compliance of its provisions with the statutory procedural requirements. The assessment of the expert’s opinion as a source of evidence has a certain specificity, which is usually understood as the establishment of the relevance, admissibility and reliability of the conclusion. Such an assessment is made during the pre-trial investigation and in the course of the trial.

Due to the increasing complexity of the expert’s findings in the use of high-tech techniques, research tools and equipment, with the emergence of new genera and types of forensic examinations with complex illustrative material in the form of diagrams, tables, drawings, diagrams, the challenges of assessing a conclusion have also become more complex. A clear example in this regard is the opinion of an expert on the results of forensic computer and technical expertise  (Shutemova, 2018, p. 193).

The assessment of the expert’s opinion is carried out by the subjects of proving according to the general rules established by Art. 94 of the Criminal Procedure Code of Ukraine, taking into account the specifics of this source of evidence, due to its legal nature, the peculiarities of its content and procedural form, and the specifics of obtaining during criminal proceedings (Vorobchak, 2019, p. 19).

Investigator, prosecutor, investigating judge, court is endowed with both procedural and non-procedural opportunities to verify and evaluate the expert’s opinion. One of the important stages of the expert study and its use in the evidence is the evaluation of the expert conclusion (Shcherbakovskyi, Stepaniuk, Kikinchuk, Petrova & Hanzha, 2020, p. 479). In this regard, the important element is the study of unique approaches and types of evaluation of the expert’s opinion in the investigation of criminal offenses, in which forensic computer and technical expertise was conducted (Khomutov, 2019, p. 266).

According to Part 2, Article 9 of the Criminal Procedure Code of Ukraine (Law of Ukraine No. 4651-VI, 2012) prosecutor, investigator, head of the pre-trial investigation body is obliged to investigate the circumstances of criminal proceedings and provide the circumstances with a proper legal assessment, ensure legal and impartial procedural decisions at the stage of pre-trial investigation. These parties, as well as investigating judge, court in their inner conviction, which is based on a comprehensive, complete and impartial examination of all the circumstances of criminal proceedings, guided by law, evaluate each piece of evidence in terms of relevance, admissibility, reliability, sufficiency and interrelatedness for making an appropriate procedural decision (Part 1, Article 94 of the Criminal Procedure Code).

That is, in order to claim that the circumstances of the criminal proceedings were given a proper, not distorted legal assessment, investigator, prosecutor should perform the following steps and demonstrate that: the materials collected by them are evidence (Part 1, Article 84 of the Criminal Procedure Code) (contain factual (indisputable), and not any data, obtained in the manner prescribed by the Criminal Procedure Code, and are relevant to certain criminal proceeding); obtained from the provided procedural sources (Part 2 of Article 84 of the Criminal Procedure Code); each of these pieces of evidence is verified and evaluated in terms of relevance, admissibility, reliability; the body of evidence is collected is assessed in terms of sufficiency and correlation; the assessment of evidence is performed not as one pleases, but in accordance with the law (with reference to this law); the inner conviction of an investigator or prosecutor is based not on an assumption, but on a comprehensive, complete and impartial investigation of all the circumstances (Nesinov, 2018).

After forensic computer and technical expertise is conducted, investigator, prosecutor is obliged to read its content and assess the expert’s opinion as the necessary condition for its use to substantiate the indictment, which concludes the pre-trial investigation. These most important procedural documents should be based only on the conclusions of the expert, the ability and final validity of which is beyond doubt.

The investigator should analyze and evaluate the results of forensic computer and technical expertise, determine the place of the expert’s opinion in the whole set of available evidence collected in criminal proceedings, evaluate the conclusions and verify compliance with the law on the procedure for obtaining and processing the results of the study. The investigator usually does not possess special knowledge underlying the conducted research and formulation of conclusions, and it is difficult to assess his (her) level of competence on the basis of the information contained in the expert’s opinion.

Note that the law does not prohibit investigator, prosecutor to seek for the advice of specialist, if necessary (for example, in the area of information and computer technology), whose special knowledge will help to objectively assess the conclusions made by the expert on forensic examination, their probative value in general and for specific criminal proceedings in particular.

The assistance of specialist in assessing the results of computer examination may be required if there are conflicting conclusions in the materials of the criminal proceedings, when the results of the forensic examination contradict other evidence collected and in case of insufficient experience of the investigator. If necessary, the specialist may advise to request documents containing information of a reference nature, to give written advice on special issues.

Investigative (search) actions do not always contain information on the facts and circumstances that are important for the proper resolution of criminal proceedings. The specialist will help to repair this omission by participating in the joint analysis of physical evidence, traces, and documents during the pre-trial investigation; for example, to demonstrate physical evidence during the interrogation of a witness, to explain the results of forensic computer and technical expertise  from the standpoint of proof or non-provision of any fact, phenomenon. It is still possible to correct the omissions and obtain evidence at this stage of the joint analysis.

When examining the conclusions of the experts, the prosecutor, who supervises compliance with the law during the pre-trial investigation in the form of procedural guidance of the pre-trial investigation (Part 2 of Article 36 of the Criminal Procedure Code), should determine whether forensic computer and technical expertise  is conducted in the manner prescribed by the Articles 242 – 245 of the Criminal Procedure Code, by the relevant person to clarify the expert opinion on the criteria of admissibility of evidence, verify the procedural rights and legitimate interests of the parties to criminal proceedings, assess the relevance of expert findings to the content of evidence, as well as other facts relevant to the consideration and resolution of criminal proceedings, determine whether the conclusions of the experts do not contradict other evidence, including those obtained as a result of other examinations.

Examining the materials of criminal proceedings before filing an indictment in court, prosecutor, assuming the possibility of requesting forensic examination (repeated or additional forensic computer and technical expertise, including forensic computer and technical expertise  as part of a comprehensive examination), should pay attention to the presence of data in the materials of criminal proceedings that allow to do so, to take measures to conduct them at the time of the hearing.

Adherence to the procedure of assessing evidence during the trial is one of the important elements in achieving fair justice in criminal proceedings. According to Part 1, Article 23 of the Criminal Procedure Code of Ukraine, the court of the first instance should directly examine the testimony, things and documents during the trial (as well as interrogate the accused, victim, witnesses, hear expert opinions, examine material evidence, announce protocols and other documents); only evidence that has been examined is subject to evaluation. The immediacy of the perception of evidence allows the court to properly examine and verify them (both each piece of evidence separately and in conjunction with other evidence), to assess them according to the criteria set out in Part 1, Article 94 of the Criminal Procedure Code, and to form complete and objective view on the facts of a particular criminal proceeding.

The expert’s opinion on the results of forensic computer and technical expertise  is of great importance in assessing the evidence during the trial, when the parties to the proceedings sometimes proactively and at their discretion present evidence to substantiate their position and show the failure of the opposite (Vardanian & Hribunov, 2017, p. 32).

Pavlova (2017, p. 213) identifies legal, factual (substantive) and tactical components in the evaluation activity and prefers the legal one, as a significant violation of law in obtaining the object of expert research, appointment and examination entails recognizing the expert’s opinion as inadmissible evidence, neutralizes its actual (substantive) value and does not allow to consider various tactics of its use in proving.

In our opinion, the general method of assessing expert’s opinion during forensic computer and technical expertise should be considered as the set of verification actions and related mental operations performed by the subject of evaluation in the optimal sequence, guided by the requirements of criminal procedural law, laws of formal logic, using various methods of scientific analysis developed by practice in the area of information and computer technology.

When evaluating expert’s opinion, it is important to find out the subjective factors that affect the results of forensic computer and technical expertise  and final conclusion: whether the expert established the conditions for the formation of traces or the origin of objects presented for the research; whether the expert used the equipment that had passed the relevant inspection and supplies suitable by terms and storage conditions; whether the expert used the methods, tools and techniques recommended for the study of specific objects; whether he (she) used them correctly (assessment of the scientific validity of expert’s opinion); the extent to which the findings of the expert study are substantiated (the validity of the expert’s opinion); whether the information presented in the conclusions of other experts, etc. was used correctly (Moisieieva, 2016, p. 81).

The assessment of the admissibility of the expert’s opinion as evidence involves the analysis of its compliance with the relevant criminal procedural rules during the expert examination. The following requirements apply both to the expert’s opinion and to the sources of evidence that form the basis of the findings of forensic computer and technical expertise. They should meet general characteristics of all sources of evidence, as well as the features specific only to electronic media. In particular, forensic computer and technical expertise should be carried out by a competent specialist; inspection of electronic media should be performed in accordance with the enshrined procedure and by the authorized persons; the course and results of investigative (search) action should be recorded in the appropriate protocol. From this point of view, electronic media should be subject to more stringent requirements, as their evaluation requires special devices and persons with special knowledge in a narrow area of science.

Without denying the importance of assessing the legal component of the expert’s opinion when conducting forensic computer and technical expertise, we note the complexity of assessing the so-called substantive (actual) component. After all, forensic examination is entrusted to a person who possesses special knowledge, and a person who does not possess this knowledge has to evaluate the expert’s opinion. This once again confirms the feasibility of using the help of a specialist or an expert.

There are also some difficulties with the assessment of the scientific validity of the chosen expert method, the legality of its application in a particular case, the conformity of the method to modern achievements in the area of special knowledge, as the court is not a specialist and does not possess the knowledge of an expert. The algorithm for evaluating the scientific component of the expert’s opinion, compliance with which is a guarantee of the comprehensiveness of his (her) assessment, is to determine: the scientific nature of the methods used; opportunities to solve the range of the tasks facing the expert with their help; the presence of the scientific explanation of the results obtained in the expert’s opinion (Siedova, 2001, p. 599 – 600).

Perhaps the only way to verify the scientific validity and reliability of the expert’s opinion is the real competition of experts, which is achieved by the ability of the parties to criminal proceedings to request the appointment of forensic examination. In this case, we can assume that the conclusions of experts from different parties to criminal proceedings should have opposite (or at least not consistent conclusions). The expert’s procedural position is neutral; he (she) is neither a party to the prosecution nor a party to the defense. It is unacceptable that the study of the same objects to answer a similar question depends on the interests of the party represented by the expert chosen by it. In real adversarial proceedings of the experts involved by the defense and the prosecution, the right to make a final decision actually remains with the court, which is forced to recognize one or another position in the court decision.

The reliability of forensic information is determined by its compliance with the relevant phenomena and processes, and the adequacy of the needs for forensic information of the subject of proving (Pisariev & Zolotov, 2018, p. 186). The most difficult task in assessing the conclusion of forensic computer and technical expertise is the task of evaluating the reliability of this type of evidence. This is due to the fact that evaluating the reliability of the conclusion involves an appropriate level of knowledge of the investigator when assessing the subject part of the examination (Averianova, 2014, p. 468). The ability of investigator, prosecutor, investigating judge and court to accurately assess the scientific validity of the expert’s opinion is still controversial, as it is necessary to possess a set of knowledge close to the knowledge of the expert to assess the validity of this type of evidence on the appropriate level.

In our opinion, the enshrinement of the right of the defense to initiate the appointment of forensic examination in the current Criminal Procedure Code of Ukraine is the only way to verify the scientific validity and reliability of the opinion of the expert, who was involved by the opposing party in criminal proceedings (including by the investigator).

Without denying the need to train authorized persons on special issues in order to properly assess the expert’s opinion, it is worth noting that this level of knowledge in the area of information and computer technology is clearly unattainable by most of them. Unfortunately, due to the complexity of the expert’s opinions because of the use of high-tech methods, research tools and equipment, complex illustrative materials in the form of diagrams, tables, drawings, diagrams, the challenges of assessing the opinion by investigators, prosecutors, investigating judges, and courts have also become more complex. These subjects have the opportunity to assess the expert’s opinion both through procedural means (interrogation of the expert by the court to clarify, specify and supplement his (her) opinion in order to eliminate its incomprehensibility or incompleteness), and non-procedural means without filling procedural documents (consultations of specialists or experts) (Sorokotiahin & Sorokotiahina, 2015, p. 141).

The expert’s opinion is not obligatory for the person or agency conducting the proceedings, but disagreement with the expert’s opinion must be motivated in the relevant resolution, decision, sentence (Part 10, Article 101 of the Criminal Procedure Code). Although the law does not establish the superiority of some pieces of evidence over the other ones, we believe that the expert’s conclusion based on the research in the area of information and computer technology are often more objective than personal and verbal evidence, for example, testimony of the person suspected.

Based on the analysis of the expert’s opinion on the results of forensic computer and technical expertise , the court, as the main and, at the same time, the final instance of assessment of sources of evidence in criminal proceedings, may take one of the following decisions: finding a conclusion complete and reasonable; finding a conclusion insufficiently comprehensive and substantiated (in this case it is possible to set up additional expertise, interrogation of the expert in court); finding a conclusion unfounded, which may lead to setting up the re-examination.

As for the use of the expert’s opinion based on the results of forensic computer and technical expertise in criminal proceedings, it is the operation of the subjects of proving during the qualification of a criminal offense, to establish facts and circumstances relevant to criminal proceedings and subject to proof, as well as to address other tactical tasks.

Thus, based on the results of the study, we can summarize that forensic examination is the most qualified form of using special knowledge in criminal proceedings. Under the assessment of the expert’s opinion on the results of forensic computer and technical expertise  one should understand: mental activity of investigator, prosecutor, investigating judge and court, in the course of which they verify that all circumstances, related to setting up this examination (requirements for the person involved, requirements for the decision (s) on the procedure for its holding, requirements for the conclusion (its structure, content, details, signatures, etc.)) are in conformity with the law; verification of the materials submitted for the examination (the procedure for obtaining, certification of physical evidence, samples for comparative research (their sufficiency), the assessment of the comprehensiveness of the study (whether all the objects have been studied, or whether all questions have been answered), assessment of the logical basis for the course and results of the study, compliance of the conclusions with the conducted research and its results.