The below article was written in 2010. I often find that the ability to think impartially is vital in many of the roles we perform and not just when investigating as a forensic investigator. I have included the complete article below even though some of the references will have changed. 

Professional Conduct 

1.    Introduction

This report will examine the implications that different moral and ethical standards of forensic computer examiners have in relation to the ISFCE’s code of conduct.

1.2 Assumptions

The reader should be familiar with:

1. the ISFCE’s code of conduct for computer examiners.
2. the Guidance Booklet for Experts [Experts2006].
3. the Good Practice Guide for Computer-Based Electronic Evidence (ACPO) [ACPO2010].

1.3 Report Structure 

The report will briefly discuss the suitability of the ISFCE code of conduct for computer forensic professionals, using the Guidance Booklet for Experts and ACPO guide as a basis for comparison.

The implications of two ethical and moral frameworks will be explored in relation to the ISFCE’s code of conduct, the first being Utilitarianism and the second Relativism. The report will show how the moral and ethical standards of the forensic computer examiner can affect their ability to abide by a code of conduct to different degrees, depending on the moral and ethical framework they hold.

In conclusion, the report will summarise the impact of Utilitarian and Relativist moral and ethical issues on the computer examiner. It will draw conclusions on its compatibility with the ISFCE’s code of conduct and make recommendations to reduce the aspects of Utilitarianism and Relativism which are not compatible.

1.4 Audience

The intended audience is prospective and practising computer forensic professionals. 
1. Code of Conduct Suitability

A suitable code of conduct for a computer forensic professional must be compatible with the principles and procedures of the job. These are outlined in the Guidance Booklet for Experts [Experts2006] and ACPO guide [ACPO2010].

Any other code of conduct a computer forensic professional personally subscribes to will be overridden by their obligations to the court, which are summarised in the Guidance Booklet for Experts [Experts2006] in three key points: retain, record, and reveal. In addition, the four principles of computer-based electronic evidence given in the ACPO guide [ACPO2010] must be followed.

The ISFCE Code of Ethics defines key points which its certified computer examiners must adhere to at all times. This code outlines general high-level guidelines, which cover all aspects of an examiner’s job for use within different legal frameworks and environments. It specifies that examinations must be based on established, validated principles, which would allow for the four ACPO principles [ACPO2010] and guidelines on evidence [Experts2006] to be incorporated.  This is important in order to comply with the legal obligations expected of a computer forensic professional. The ISFCE’s code of conduct goes on to state legal orders of the court must be complied with and an examiner should never engage in illegal or unethical conduct.

The rules of the ISFCE states an examiner must “Abide by the highest moral and ethical standards and abide by the by-laws of the ISFCE”. It does not specify what ethical framework should be followed, so theoretically there would be no conflict with using any doctrine on this point.

The ISFCE’s code states that an examiner should not engage in unethical conduct, but again it does not give any detail. Any examiner will encounter ethical issues during an investigation e.g., if a computer forensics professional is investigating a disk from a lawyer, any communication between lawyer and client are subject to ‘legal privilege’. This means these communications cannot be examined or used as evidence in a forensic report [Bryant2008]. If the examiner is then asked to disclose the information a decision must be taken to comply or not which places the examiner in an ethical dilemma.

The ISFCE code of conduct does not cover ethical issues in any detail, but advocates the use of ethical standards and professional integrity in the following points:

• Always demonstrate integrity in completing professional assignments
• Always abide by the highest moral and ethical standards and abide by the Code of the ISFCE
• Always avoid any action that would knowingly present a conflict of interest
• Never engage in any unethical or illegal conduct

A computer forensic professional’s duty to accurately record, retain and reveal all evidence and documentation created or used during an investigation is covered by the following points:

• Conduct examinations: obtain evidence or other documentation that will establish a reasonable basis for any opinion rendered
• Testify truthfully in all matters before any board, court or proceeding
• Maintain the utmost objectivity in all forensic examinations and accurately present findings

The ISFCE code of conduct does not conflict with the forensic professional’s duty to the court or use of other guidelines on evidence gathering and investigation. It outlines high-level guidelines, which fit well with a computer forensic professional’s job and therefore is suitable as a code of conduct.

2.    Utilitarianism

A Utilitarian is someone who follows the doctrine of Utilitarianism, which is defined by the Oxford English Dictionary as a “doctrine that the greatest happiness of the greatest number should be the guiding principle of conduct” [OEDUtil]. The “greatest happiness” is an outcome, which maximises the good for all. Utilitarianism is further defined by its “impartiality and agent-neutrality” [Stanford2009].

I have explored the ISFCE code of ethics and professional responsibility from a Utilitarian point of view, using examples where necessary, in order to demonstrate the impact a Utilitarian perspective would have on a forensic investigation and how it would affect the computer examiner’s interpretation of the ISFCE’s code.

The ISFCE’s code requires examiners to “Maintain the utmost objectivity in all forensic examinations and accurately present findings”, which aligns with the Utilitarian values of “impartiality and agent-neutrality”.  A Utilitarian examiner could choose to omit evidence from a report if they believed the “greatest happiness” would be achieved. However, if the examiner takes into consideration the values of “impartiality and agent-neutrality”, it will counteract the subjectivity of the “greatest happiness” value.

Bernard Williams [Stanford2006] argues against Utilitarianism using the example of Jim and the Indians, which places Jim in a position where he is given the choice to kill one Indian in order to save 20 being killed. If Jim does not kill one Indian all the Indians will die, but if he kills one, the rest will live. The Utilitarian would see the best solution, from an impartial and “greatest happiness” perspective would be to kill one and save the rest, but this would be against the law and therefore the ISFCE’s code of conduct.

This scenario could be likened to a Utilitarian computer examiner being asked to investigate and retrieve information from a contract employee’s own computer who is suspected of selling intellectual capital to a rival company. The company has no real evidence linking the contract employee to the alleged selling of intellectual capital and no right to access the contract employee’s own computer. The examiner is told that thirty employees could lose their jobs if the person selling the company’s intellectual capital is not found. If the examiner does retrieve the information asked for, they would be breaking the ISFCE’s code of conduct.

The only solution according to the ISFCE’s rules would be to refuse to retrieve the information without the proper permission or a warrant. The Utilitarian objective to attain the “greatest happiness” regardless of the method used would lead the examiner to consider carrying out the investigation and data retrieval as it would provide a better outcome for more people. However, the Utilitarian objective of “impartiality and agent-neutrality” would complement the ISFCE’s code of conduct as long as there is also a belief by the computer examiner that the ISFCE’s code of conduct will bring about the “greatest happiness”.

3.    Relativism

Relativism prescribes that all knowledge, truth and morality are relative to the situation rather than absolute [OEDRelat]. Relativism is defined further by “the assertion that human values, far from being universal, vary a great deal according to different cultural perspectives” [UN1995].

In the state of California, a sexual act between an individual 18 years or over and someone 14 years or younger is illegal, however, among Young Unassimilated Hispanic Offenders (YUHO) this crime is much more common than within the rest of the population. This can be attributed to the home culture where it is acceptable behaviour [Apodaca2005]. A relativist would consider the home culture and argue that it should not be illegal for YUHOs as this behaviour is acceptable in their home culture.

Based on the example of the YUHO, a Relativist computer examiner is asked to investigate a case and look for evidence of child pornography on the laptop of an unassimilated Hispanic person of 18 years old. The examiner finds images of the person’s naked 14-year-old girlfriend and has to decide if these can be classified as child pornography. As a Relativist, the examiner decides to take into account the cultural background and determines that the images found do not depict child pornography, but this is contrary to the ISFCE’s rules.

The ISFCE rules state that an examiner should not express an opinion on guilt or innocence or show a bias or prejudice on an assignment. This decision to overlook the images of the 14-year-old Hispanic girl is contrary to this ISFCE rule and the laws of the state of California, but to a Relativist it would be the most appropriate action.

An examiner certified by the ISFCE must comply with the rules at all times. A Relativist could agree to abide by the rules, but when faced with a particular situation decide that it would be best to break any or all of the rules. e.g., if a Relativist believes other computer examiners are not following the rules, it would seem to be acceptable that the rules do not need to be followed, as relative to his/her peers there is nothing wrong. This scenario is very similar to the example Janet Lasley and Ilayna Pickett of the Woodrow Wilson Biology Institute used which saw students justify cheating as other students in the school were also cheating [Woodrow1992].

The Relativist viewpoint will affect the examiners’ ability to adhere to any of the rules in the ISFCE’s code of conduct as they rely on the examiner to accept the standards and apply them objectively regardless of the situation. If every individual shared the same ethical and moral standards or the Relativist examiner worked exclusively within the cultural values of one society, there would be no conflict. The reality is that the world consists of many societies, each with their own set of cultural values, and even within one society, individual moral and ethical values may be different.

The practice of sharing music via file sharing internet sites has been common practice among internet users for a number of years now, even though it is illegal. The music industry has tried to make it more difficult to copy and share music using copy protection methods, and it has also tried to change people’s opinions in order to discourage sharing of music. If the rules of the ISFCE and the law in the UK were followed, a 17 year old sharing music with friends via the internet would be committing a crime. This does not necessarily align with the moral and ethical standards held by the majority of society though as seen in Middlesbrough when a case was dropped in the crown court against a teenager for piracy, as it was not in the interest of the public [ITPRO2010].

Although a computer examiner may agree that a teenager should not be charged with piracy, his/her opinion should not interfere with the collection of evidence. The duty of the examiner is to comply with the legal orders of the court objectively without expressing their own opinion. The Relativist would consider the situation in relation to the moral and ethical standards of society in order to decide how to proceed, which may not be aligned with the ISFCE’s code of conduct.

The ISFCE’s code of ethics should ideally be adopted universally by all computer examiners without personal or cultural values being taken into account, no matter what the current situation is. In reality, every computer examiner is an individual with his or her own cultural background, which will inevitably affect how they interpret the ISFCE’s code of conduct.

4.    Conclusions

The requirement to be objective and uphold the highest moral and ethical standards of society are extremely important to the computer examiner as their job is to collect evidence without expressing their own opinion and represent the facts using established and validated principles.

Although performing a forensic examination should consist of collecting facts, it is clear that there are instances where the judgement of the examiner is required, such as determining if a digital image depicts child pornography or information collected is subject to client privilege. It is therefore important that any moral and ethical standard held by the examiner do not conflict with the law and a code of conduct such as the ISFCE’s.

Because the moral and ethical standards of any society change over time, it is important for all computer examiners to be aware of these changes, as standards may conflict with the law, as is the case with illegal file sharing of music, but the computer examiner should look to the law as the overriding rule.

The Utilitarian doctrine appears to be a suitable ethical and moral standard for an examiner as it embraces the concepts of “impartiality and agent-neutrality” which are important components of the ISFCE’s code of conduct. However, the subjectivity of the “greatest happiness” principal conflicts with the ISFCE’s requirement for objectivity.

Relativism does not present itself as a moral and ethical standard which complements the ISFCE’s code of conduct, primarily due to its subjectivity and not advocating the use of the same methods or rules in all instances. It is however important to be aware of the moral and ethical issues a Relativist viewpoint raises as we are all subject to this kind of thinking to some degree.

The ISFCE’s code of conduct goes a long way to help and guide the computer examiner in making the correct decisions. However, in order to maintain the high ethical and moral standards expected of a computer examiner, peer review and sharing of ideas is vital to reduce subjectivity and to take the onus away from the individual when faced with important ethical dilemmas. This would help maintain integrity and professionalism in the field of forensic investigation.

5.    References

[ACPO2010] Good Practice Guide for Computer-Based Electronic Evidence

http://www.7safe.com/electronic_evidence/ACPO_guidelines_computer_evidence.pdf , 24 July 2010 (last accessed)

[Apodaca2005] de Apodaca, R.F. et al., Young, unassimilated hispanic offenders: Absolutist vs. relativist cultural assumptions. Sexuality & Culture, 9(3), 3–23, Concordia University, 2005

[Bond2007] Bond C. et al, The Expert Witness - A Practical Guide, Shaw & Sons, November 2007

[Bryant2008] Byant R. et al, Investigating Digital Crime, John Wiley & Sons Ltd., 2008

[Experts2006] Criminal Prosecution Service, Guidance Booklet for Experts – Disclosure: Experts’ Evidence and Unused Material, Blackburn of Bolton, http://www.cps.gov.uk/publications/docs/experts_guidance_booklet.pdf, 2006 (date written)

[ITPRO2010] CPS drops piracy case against 'scapegoat' teen | IT PRO. http://www.itpro.co.uk/621982/cps-drops-piracy-case-against-scapegoat-teen, 31 Mar 2010 (date written)

[OEDRelat] Oxford English Dictionary relativist, http://dictionary.oed.com/cgi/entry/50201896?query_type=word&queryword=relativism&first=1&max_to_show=10&single=1&sort_type=alpha, 21August 2010 (last accessed)

[OEDUtil] Oxford English Dictionary utilitarianism, http://dictionary.oed.com/cgi/entry/50274046?single=1&query_type=word&queryword=utilitarianism&first=1&max_to_show=10 , 21 August 21 2010 (last accessed)

[Stanford2006]  Williams B.,  (Stanford Encyclopedia of Philosophy) http://plato.stanford.edu/entries/williams-bernard/#Day , 20 August 2010 (last accessed)

[Stanford2009] The History of Utilitarianism (Stanford Encyclopedia of Philosophy) http://plato.stanford.edu/entries/utilitarianism-history/, 21 August 2010 (last accessed)

[UN1995] Ayton-Shenker D., The Challenge of Human Rights and Cultural Diversity,  http://www.un.org/rights/dpi1627e.htm, March 1995 (date written)

[Woodrow1992] Lasley J. et al,  INTRODUCTION TO TYPES OF ETHICAL SYSTEMS, http://www.woodrow.org/teachers/bi/1992/ethical_systems.html , 11 September 2010 (last accessed)