The Philippines does not have any Supreme Court jurisprudence on the proper conduct and standards pertaining directly to digital forensic investigation, nor the commission of digital forensics fraud. The current revised rules on civil and criminal procedure have no provisions relative to these matters. The Rules on Electronic Evidence which had been amended last 2002 (yes that’s right, 20 years ago) have no applicable relevant provisions that address these.
To be fair, the Philippines had adopted several ISO/IEC standards on the acquisition, preservation, examination of electronic data and the presentation of the digital forensic investigation report (DFIR) by the cyber forensic investigator (CFI). But the tragedy is, apparently, most, if not all, of the Philippine cybercrime court judges, prosecutors and defense counsels are not aware of these standards. These are not taught in law schools and even in MCLE seminars. Even the CFIs that I have encountered are not aware, or if they are aware, they do not follow these standards.
I first experienced dealing with CFIs and analyzing their DFIRs more than a decade ago, first in administrative cases, then in cybercrime cases. I had always desired to do a full pledged half day seminar on these matters containing my experiences, but since I am not an established training provider, I have to scout for one that can accommodate my advocacy for ethical digital forensic investigation and reporting. The Alternative Center for Continuing Education and Seminar Solutions, Inc. (ACCESS) and Adamson University College of Law trusted me to give a 2 hour lecture for their MCLE Synchronous series last October 14, 2022. I confirmed from the MCLE Monitoring Unit of the Philippine Supreme Court that it was the first lecture on Digital Forensics Fraud in the history of the Philippine MCLE.
The response was quite positive that I was invited to give another lecture last December 9, 2022 for ACCESS and Adamson College of Law, on the same subject. But of course, I changed some portions and included new portions.
In both lectures, I made clear to the participants that I am not a certified CFI, nor have I represented myself to be one at any time. I serve as a cyber law expert witness and my qualifications have been recognized by Philippine cybercrime courts. In doing my tasks, I look primarily at the content of the DFIRs, and I analyze them according to the germane international and national technological and industry standards and regulations, appropriate jurisprudence from different jurisdictions, and significant scientific and academic literature that validate the technological tools and processes that were employed by the CFIs.
I delineated the technological “musts” in gathering, securing, and examining the electronic data that CFIs had copied from the original suspect devices and systems, from which no deviation is generally allowed. I utilized the framework of Dr. Turvey in his book “Forensic Fraud: Evaluating law enforcement and forensic science cultures in the context of examiner misconduct” published by Elsevier.
I presented to the attendees several patterns in the DFIRs that I have examined, the testimonies under cross-examination of the CFIs, and their alleged bodies of work, which underscore the fact that these CFIs rely on the ignorance of judges and lawyers concerning the nature of electronic data, and the proper procedures in their collection, the safeguarding of their original content, including their metadata, the correct examination procedures, and the ethical presentation of the findings of the CFIs in the DFIRs in courts and quasi-judicial bodies. The actuations of these CFIs, in my opinion, are tantamount to digital forensic fraud, bolstered with my analyses of the characterizations of forensic fraudsters provided by Dr. Turvey.
Another indication of digital forensic fraud are the misrepresentations by the CFIs of their educational qualifications, their professional certifications, their employment history, their technical publications, and their alleged non-confidential bodies of work (e.g., Manuals, IRRs, SOP pamphlets, etc.) that they have presented to government agencies that supposedly employed them as consultants. I apprised the participants of the necessity of going thru all of the evidence presented by these CFIs on these matters, including examining the content of the CFIs’ social media accounts, to find out signs of untruthfulness in their declarations, that are sufficient enough to dismiss them as charlatans or “quack” experts.
Due to the fact that electronic evidence is now implicated or involved in all types of cases, it is imperative that the Philippine legal profession, and the judiciary should actually take a closer look at how these CFIs operate in terms of gathering, securing, examining and presenting electronic evidence; what and how their qualifications are presented; and the quality and truthfulness of their DFIRs. CFIs impact on the proper administration of Justice in the Philippines, as well as the lives of those people (mostly accused), who find themselves on the receiving end of the unethical and criminal acts of these CFIs. The stakeholders in the Philippine legal and judicial systems need to be more vigilant because unfortunately, these CFIs (who are not holders of licenses administered by the Philippine Regulatory Commission, or who are not regulated by any government or private agency) cannot be held accountable by any Philippine professional entity, except by filing criminal and civil cases against them in court. The presentation and admission of their fraudulent DFIRs and their testimonies taint the whole judicial system, and if not stopped, can lead to the admission of fraudulent “junk science” in Philippine jurisprudence.
Philippine Law Bytes: TheCyberLawyer Issues by Dr. Attorney Noel Guivani Ramiscal 