CYFOR Blog

Tunnel vision is an unfortunate side effect of the desire to prove an allegation. This is where flaws in social media investigations can arise.

By Matt Lashley | Head of Investigations

I’d like to start by saying I’ve reviewed stacks of first-rate prosecution reports over the last two years. Nationally, our LEAs (Law Enforcement Agencies) have some exceptional Digital Investigators, who’re producing solid evidence via cutting-edge tactics and tools. Given the rapid growth of technology and strain on resources in the public sector, this is no mean feat.

However, this isn’t always the case. Occasionally I find data which has been misinterpreted, resulting in inaccurate statements which are misleading to their audience. From my experience, the most common reason for said errors relates to a lack of effective training and a fundamental misunderstanding of the subject they’re addressing.

That’s why we have defence experts. The role of the defence expert – in the most simplistic form – is to review the prosecution evidence and ensure that it’s accurate.

Case Study: Reverse-Image Searching

Whilst investigating a report of revenge porn, investigators established that intimate pictures had been uploaded to the victim’s hacked social media account. The suspect was questioned about several areas of the case, including the proposition that he was one of only two people in possession of the images – the second being the complainant.

The suspect denied this, stating they had previously been uploaded to a website, meaning anyone who had access to the internet may have also been in possession of them. The investigator in this case set about disproving this defence by way of reverse image search.

So, what is a reverse image search?

“Reverse image search is a search engine technology that takes an image file as an input query and returns results related to the image. Search engines that offer reverse image capability include Google and TinEye.” Quote from whatis.com

Essentially, rather than searching the internet for words, a reverse image search looks across the internet for a particular image. In their statement, the investigator explained how they’d conducted a reverse image search on the intimate pictures and established that the tool of use returned zero results. The inference being, the pictures couldn’t have been uploaded to a website as the search hadn’t found them. Anyone with a basic understanding of search engines, websites and the internet will understand why this process was flawed; search engines can only look for indexed data.

Search engines use automated scripts known as ‘web crawlers’ (sometimes referred to as ‘bots’ or ‘spiders’) to browse and index the contents of webpages. The crawlers need access to the page if they’re to view and index the contents. Now, bearing in mind this is an automated script, if they come up against a login page or captcha box (which require human interaction), they’re usually stopped in their tracks.

I’m sure you’ve seen these before. They’re designed to stop bots from accessing the page and viewing the data. Suffice to say then, if the crawler can’t access the site, data and pictures/images on that site cannot be indexed and if they can’t be indexed, they will not be found via reverse- image search.

So back to the statement from the investigator. When reviewing this evidence, I looked at the two websites which the suspect claimed to have uploaded the initiate pictures too. Both had login pages and required an account to be set up prior to accessing any content. Naturally, my next step was to create an account on each site, allowing me to review the content. Once complete, I took a generic image from both sites and ran them through the same reverse image tool used by the investigator. Both returned zero results. The images were present on the websites but didn’t return on the search. This was obviously due to the fact that both sites were unable to be accessed by web crawlers from the search engine.

Conclusion

Having documented my tests and findings, I compiled a report which highlighted the limitations of the investigator’s statement. I would like to add; this wasn’t the sole evidence in this case and I only addressed one of several issues in relation to the digital evidence.

My report opined that the evidence was inaccurate and could potentially mislead a non-technical jury if they were to hear it. Additionally, it highlighted numerous other missed opportunities – which if pursued – could have strengthened the evidence significantly.

Investigators should not become blinkered. Tunnel vision is the unfortunate side effect of the desire to prove an allegation. This is where flaws in social media investigations can arise. We must remember that investigations are impartial and what’s important is establishing the truth.