Recently, I sat down with Lee Russo and Daniel Dvorak (retired Chief of Police for the Cambridge, MD Police Department) to get their perspectives on why police departments need to invest in Digital Evidence Management (DEM) and what to look for in a DEM solution. Here’s a list of their ten ‘must-haves.’
1. Mobile Data Collection
Police departments across the country are equipping officers with smartphones. Officers can access 911 calls, run license plate and criminal background checks, fill out accident and domestic violence reports, take crime scene photos, and conduct field interviews, all from their mobile phones. The Jersey City PD is even testing a smartphone app that transforms everyday smartphones into body cams.
So if smartphones can be force multipliers for officers in the field, then why not for investigators as well?
Thanks to new Digital Evidence Management technology, they can. Using new DEM solutions, investigators can connect to a browser-based Investigator Portal from their smartphone or tablet, and upload digital evidence (recorded statements, photos, video, etc.) into a case file, while still in the field. In addition to saving time (driving back and forth), investigators can start collecting and building their case before they even return to the station.
“The faster you get information, the faster you can take action on it,” explains Russo. “Being in the field and having an ability to collect and share evidence or other investigative information keeps investigators in the field actively engaged with their cases. With today’s technology and systems integrations, investigators can collect, connect and chase leads right from the phone in their pocket. Every cop can have a crime analyst in their pocket.”
2. Analytics to transform data into actionable intelligence
Successful investigations rely on an investigator’s ability to connect the dots across many sources of digital evidence. Connecting the dots is the only way to get from data to actionable intelligence.
The problem is – digital evidence is stored in silos. Investigators may have tools to extract and analyze data from individual systems and datasets (for example, RMS, CAD, body-worn video, audio recording, etc.), but they don’t have analytical solutions that work across all of these systems.
“Manually searching for data across systems, and then trying to draw connections is really beyond the reasonable human capacity of any organization, and it’s easy to miss things that lie between data sources,” said Russo. “If the investigator is doing an analysis in one silo, that silo is not looking at what’s happening in a different data source or case to compare and draw references between the two.”
“What investigators really need is a DEM solution that reaches across all structured and unstructured data sources and applies analytics to make connections the investigator can act on,” said Russo. “It’s not just looking at data in one silo; it’s using a correlation engine to relate that data to data in other silos, and bring back every potentially relevant piece of evidence.”
And it’s not enough to just search across databases, DEM solutions also need to be able to search within the content of records to pull back evidence too.
For example, an investigator can use DEM to search by key words or phrases and automatically find records (e.g. audio recordings, narratives from CAD comments, incident reports, FI cards, etc.) that contain those words or tags. Today, an investigator would need to read or listen to each item in entirety.
Another benefit of DEM is that it enables investigators to correlate current and past cases. For example, if an individual was even mentioned in another case, the DEM solution would automatically bring that information to the investigator’s attention.
3. Information sharing
Successful investigations require information sharing on many levels. The public needs to share information with the police, investigators need to share information with each other, and case evidence needs to be shared with the prosecutor.
For most police departments though, these processes are highly ineffective and manual.
Take crowdsourced evidence for example. Crowdsourced evidence in the form of videos, photos and tips often provide some of the best leads in cases. Multiple surveys (including one conducted by NICE, and another conducted by Unisys) reveal that citizens are willing to share evidence with police departments to combat crime.
In spite of this, most departments lack good methods for crowdsourcing evidence. In the aftermath of the Boston Marathon bombing, authorities set up a tip line and an email address for photos and videos. The server quickly crashed due to the heavy volume of submissions.
The process of uploading large files from a phone can also strip metadata (timestamps and GPS) that’s critical for investigations. Some email programs and social media apps compress images which reduces their quality. Tips can also be submitted through websites, but these databases are generally not connected to other systems, so they become just one more piece of isolated data.
In addition to video and photos captured on bystanders’ phones, CCTV is another important type of crowdsourced evidence, but collecting it can be challenging. Officers have to drive to the crime scene, canvas the area for cameras, locate the business owner who knows how to operate the DVR, then download the video to removable media, usually only to return to the station to find it’s not playable.
Some DEM systems solve these problems by providing a secure portal where citizens can upload photos and videos, which are then stored in a secure cloud, along with file metadata. When files are uploaded, investigators are alerted to crowdsourced evidence that may be relevant to an active case.
Mapping camera locations is also a good practice as it reduces time spent searching for cameras around a crime scene. Businesses can register their CCTV cameras through the portal, making it easy for investigators to identify which cameras may hold clues to crimes they’re investigating. Asking for contact information during the camera registration process makes it easy to reach out directly to the person who controls the DVR.
Law enforcement agencies also need to be able to share information in an efficient, effective, and timely manner, not just among internal investigation teams but with other agencies. The right DEM solution can streamline these processes. Instead of copying evidence, an investigator can share a virtual case folder simply by providing permissions-based access to a folder and its contents.
The rapid growth in digital evidence has also created growing pains as departments navigate how to share evidence with DAs who need it to support successful prosecutions. Investigators typically spend hours copying case file information onto CDs, DVDs and thumb drives, and hand delivering it to prosecutors.
DEM systems address these issues by bringing digital evidence sharing into the digital age. Investigators can share evidence with prosecution teams at the touch of a button, by emailing a link to a read-only copy of the digital case through a secure portal. The system automatically tracks who accessed what and when, to ensure chain of custody.
Finally, cases have been derailed over questionable disclosure practices and missing evidence. DEM not only ensures the integrity of evidence within the justice system, it also ensures the integrity of the overall system of justice, by standardizing the evidence sharing process and ensuring its predictable and consistent performance.
4. Making proprietary video playable
CCTV has long been important to investigations. It played a role in identifying the perpetrators who carried out the London Underground bombing in 2005. Hundreds of hours of footage, aided by an eyewitness account, also helped identify the Boston Marathon bombing perpetrators, and their movements before and after the explosion.
But the sheer volume of the footage is not the only challenge. Investigators often bring CCTV video back to the station only to find they have zero ability to play it. Proprietary codecs are needed to make videos playable, and they can be hard to find and obtain.
The lack of industry standards in CCTV has turned proper recovery of digital video evidence into a research project. To make matters worse, if a case is dormant over a period of time, or office computers are replaced, an investigator may need to start the process of searching for codecs to convert the video all over again.
“It’s a time and cost problem,” said Dvorak. “In a larger department, an investigator may have a video specialist on staff, but they’re not going to be on staff in the middle of the night. Or the investigator may have to wait for someone in an entirely different department to send the video out to a private vendor. And if an investigator has to go to another IT department in the jurisdiction, his case is probably not going to be their top priority.”
DEM offers a better way, by automatically transcoding video into a standard format that can be played on any desktop, laptop, tablet, or smartphone.
“The DEM solution creates a working copy of the video, and maintains the original version to insure the integrity of the evidence,” said Dvorak. “And if a file ever needs to be replayed years down the road, they don’t need to go hunting for the codec. The file opens and plays immediately; and when shared with prosecution, they can play the media as well.”
If there are multiple videos, standardizing the format means they can even be viewed and synchronously played back in a timeline, along with other multimedia (e.g. body-worn video, in-car video, audio recordings). “This provides compelling evidence for a judge or jury,” said Dvorak. “Watching the scene unfold in real-time gives them a feeling of being there.”
5. Information alerting
In the early stages of a major case, investigators need to run every single lead to the ground. When there are many moving parts, it’s challenging to keep track of everything.
“An investigation is a very fluid process. You’re working as a team and people are constantly seizing evidence, adding evidence, analyzing things, sending things, bringing things to the lab, getting reports completed; it’s difficult to keep track of all these changes to your case, using regular follow up methods like phone or email,” said Dvorak.
DEM automates the tracking of evidence requests, and notifies investigators when requests are fulfilled. This makes it easier for an investigator to stay on top of active cases, and not lose track of evidence or leads. It’s also helpful from a discovery standpoint. The investigator is always aware when evidence is added to a case. The investigator is also alerted when a business responds to an electronic request and uploads CCTV video.
If detectives are working a case together, they can also be alerted when a team-member adds evidence to a case folder. Supervisors can also proactively monitor the status of cases through this feature.
Finally, the DEM system will also alert an investigator if evidence added to another case surfaces that could be relevant to their case as well.
6. Automation
"Investigators know that every investigation is a race against time,” said Dvorak. “Leads grow cold, and in certain cases, time can make the difference between putting offenders behind bars or leaving them free to commit more crimes.”
By providing a single system for the investigator to do their work, and automating the processes around collecting, analyzing and sharing digital evidence, DEM solutions not only save significant time and money, they can help get criminals off the streets faster.
By way of example, for just one homicide case, an investigator could save weeks of time just by automating processes around finding, collecting and converting CCTV video; and save many more days that would have been spent manually searching across multiple data sources for evidence, waiting for audio recordings, building a timeline, and copying evidence onto CDs, DVDs and thumb drives. Speeding up the time to case closure can in turn lead to earlier charging decisions and even an increased likelihood of guilty pleas.
Automation also has the added benefit of removing the variance of human error around the processes of collecting, analyzing and sharing evidence.
“Once you identify and upload the evidence for your case, the system takes care of how it’s handled, automatically making working copies, and locking it down,” said Russo. “It standardizes these practices which makes them much more defensible when you get into a prosecution scenario where you need to prove how you’re handling evidence. It’s all automated; there’s no variation. The more automation you have, the fewer times you have to touch the evidence, the cleaner your chain of custody.”
7. Single sign on for investigators
Patrol officers do most of their work in RMS; dispatchers work in CAD; but investigators still don’t have one platform to do all of their work in. Instead, investigators need to log into lots of different systems to pull data, not just body cams, but ALPR, in-car video, interview recordings, CAD, RMS and more. And what they can’t access on their own (for example, 9-1-1 recordings) they need to request from other departments.
A recent survey (The Digital Frontline: Rethinking the use of data and information in modern policing), puts numbers to the problem. The report says: “One of the most significant drawbacks of existing police software, aside from poor search functionality, is the disconnected nature of the systems,” also referred to in the report as chair swiveling. When asked how many different systems they typically needed to log into to work on cases, 95% of survey respondents said at least two systems, and 25% said they needed to log into anywhere between six and more than eleven.
The right DEM solution can be the glue that brings systems together. DEM provides a one-stop shop for gathering evidence – the investigator no longer has to waste time logging on to all of the individual systems to manually collect evidence to build their case. Having a single Investigative Portal for conducting work also empowers investigators to perform a universal search for evidence across all connected data sources.
8. Software agnostic
In choosing a DEM solution police departments should also make sure that the solution is software agnostic, meaning that it can integrate with any digital policing solution your department uses (type and brand). The DEM solution should integrate seamlessly with other systems through an open integration layer.
“I’ve spoken with counties where a single prosecutor in the county might be working with four different police departments, each using a different Records Management System; it can be a nightmare,” said Dvorak. “But because the DEM solution sits on top of underlying systems, such as RMS, all of this information can now be packaged in a standard format and virtual case file. The fact that the underlying systems are all different is transparent to the prosecutor.”
An added benefit of this approach is that it’s also future-proof. Agencies can upgrade or replace underlying systems as needed, without having to do a complete ‘rip and replace’ of their overarching DEM solution. The right DEM solution must also be adaptable, as crime, and the systems necessary to conduct investigations into crimes, evolve as well.
9. Adaptable
Also make sure the DEM solution is adaptable to your department, not the other way around.
“You don’t want to get pigeon-holed by choosing an off-the-shelf type DEM solution that doesn’t support your workflows, and only integrates to one or a few pre-determined digital evidence sources and/or brands,” said Russo. “You want a DEM system that can be tailored to the systems and processes you use, rather than being forced into the vendor’s way of doing things.”
10. Cloud-based, scalable and secure
As police departments are increasingly inundated by digital evidence, they are turning to the cloud. The inherent scalability of the cloud means DEM solutions can more easily adjust to meet an agency’s changing investigative workloads and evidence storage requirements. For instance, if you have a major incident which results in thousands of uploads the DEM system can automatically increase processing power to accommodate the demand. Cloud-based DEM solutions also eliminate the up-front hardware and resource costs associated with premise-based solutions.
Be sure to look for a cloud-based solution that is CJIS compliant, and also protects data through strong encryption, 2-factor login authentication, antivirus protection, and built-in chain of custody tracking.
About the Author:
Linda Haelsen is the Marketing Communications Manager for NICE Public Safety, with experience spanning two decades. Linda joined NICE following the acquisition of Dictaphone. Linda has published many articles on topics spanning public safety and security.
