Every year, police departments struggle to manage exponentially more digital evidence. Inexpensive digital CCTV systems are now commonplace in communities, while crime scene photos, recorded interviews and citizen-shared digital evidence are also more frequently being handled by officers and detectives.
To add to this, many agencies have adopted in-car and body-worn camera (BWC) systems ensuring high-resolution video must be stored and managed for even minor police calls.
The CCTV market has hit an inflection point where surveillance video systems are now affordable, capture high-quality video, and are easy to install and set up. Cloud-based systems (such as Blink, Arlo and Ring) can be installed in just a few minutes by virtually anyone with a wireless internet connection. Almost no technical skills are needed. This has led to a surge in CCTV cameras being installed in neighborhoods around America.
Departments simply cannot ignore all of this digital evidence. Police administrators have a responsibility to provide officers with basic digital evidence competency training, particularly in recovering and reviewing surveillance video. Agencies must also have a system in place to collect, store and manage digital evidence utilizing best practices and adhering to laws and regulations within their jurisdiction.
The stakes are high. Lost or mishandled digital evidence calls into question an agency’s credibility while jeopardizing important cases. A Digital Evidence Management System (DEMS) is the virtual command post for managing all the digital evidence a police department collects. A DEMS, along with training and department policy utilizing best practices, ensures agencies properly collect and maintain their case evidence.
Here are 16 features to look for in a DEMS solution:
1. Secure and compliant
There is a significant risk of storing just one copy of any file. If the storage system crashes or specific files become corrupt, it may be necessary to utilize backup copies. Therefore, it is best practice to have at least two copies (three is preferred) stored in different geographic locations and storage systems. For example, digital evidence could be stored locally (on-premise) with backup copies in the cloud. Storage redundancy ensures backup copies of digital evidence always exist.
A DEMS can store digital evidence locally (on-premise), in the cloud, or both. Evidence storage must comply with FBI Criminal Justice Information Services (CJIS) security policy, and agencies must also follow local regulations.
Access to digital evidence is designated within the DEMS at individual and group levels. Personnel are granted or denied access to specific case types based on their role in the police department. For example, patrol officers may be given general access to digital evidence in the system, but excluded from accessing special assault evidence; while detectives investigating special assault cases would be granted full access. Individual and group level access privileges are set up by the police department and can be updated or modified at any time.
2. Storage agnostic and scalable
The DEMS you choose should be flexible and integrate with a wide variety of storage types. For example, a small police department may elect to store their evidence internally on a Synology NAS while larger departments may opt to utilize more expensive hybrid on-premise/cloud solutions. The DEMS should also be scalable, allowing departments to increase their storage capacity as necessary or daisy chain multiple storage options together.
Be cautious of venders who suggest locking into their proprietary storage solutions as the cost of maintaining the DEMS may get prohibitively more expensive each year. In addition, it can be challenging and costly to migrate digital evidence to another solution after being locked into a proprietary system.
3. Integrates with BWC systems
A body-worn camera (BWC) system is not a DEMS solution. As police departments adopt BWC systems, it’s becoming increasingly important for BWC and DEMS solutions to work together. Integration between these two systems allows investigators to bring together all the digital evidence associated with a case for review.
For example, in a homicide investigation, an agency may have 10 or more BWC videos from patrol officers who assisted or were on scene. There may also be digital photographs, surveillance video from multiple locations near the incident, audio and video recorded interviews, as well as other digital evidence. A flexible DEMS can handle all of this digital evidence in one place. It should also be device agnostic, meaning you’re not required to use specific hardware. By using a centrally managed and non-proprietary DEMS, you should be able to ingest BWC video from any vender should you decide to switch systems.
4. Support for seamless migration of your digital evidence
Ongoing support is critical to successfully deploying a DEMS. Without a team of experienced installers and knowledgeable subject matter experts, you may be left managing your evidence alone or forced to pay high support fees to get help. The DEMS solution you choose should include a full-time team dedicated to setting up and migrating your existing digital evidence into the new system, as well as providing ongoing technical and professional support.
5. Flexible deployment options
Some DEMS solutions are installed as an on-site application, while others are web-based. A comprehensive DEMS solution offers both options. How the DEMS is implemented dictates how and where officers can upload and review evidence. Police administrators and detectives may use a desktop application (installed on their workstations), providing them with deeper access to case evidence and functionality. At the same time, patrol officers may simply need to upload digital evidence via a web-based interface from time to time throughout their shift.
Police departments with more than just a few officers, or precincts and sub-stations spread out geographically need a DEMS that can be accessed virtually anywhere within the organization’s network. A DEMS solution that provides desktop applications and web-based options provides agencies unlimited flexibility. If the DEMS can be accessed via a web browser, virtually anyone on the network can upload and review digital evidence (provided they are authorized users). In addition, since web-based access doesn’t require special software to be installed and maintained on every workstation, this significantly reduces the amount of time an organization’s technology department must spend supporting desktop systems having the DEMS application installed. Be on the lookout for a system that offers flexibility.
6. Chain-of-custody evidence tracking
As with physical evidence, digital evidence must be tracked in detail throughout its lifecycle. One of the most basic functions of a DEMS is to track digital evidence chain-of-custody.
A DEMS will catalog every person who has accessed individual files and itemize the date and time case evidence has been viewed, downloaded, printed, or shared. The system should also include comprehensive reporting tools allowing investigators to quickly print chain-of-custody reports detailing every interaction beginning when the digital evidence was first ingested into the system. Not only does this ensure the integrity of the digital evidence for court, but it also gives police administrators tools to discover how digital evidence may have been inappropriately viewed or even shared outside the department. For example, if a sensitive video from a case was posted on social media, administrators can produce a report detailing every person who interacted with the video and other digital evidence in the DEMS. This encourages department-wide transparency and accountability.
7. Original digital evidence never changes
While testifying in major cases, I have faced defense attorneys challenging the integrity of digital evidence being introduced by the prosecutor. It usually starts with a question from defense along these lines, “Detective, how do we know this is the same surveillance video you recovered two years ago, and it hasn’t been altered in some way?” A question like this can be an effective defense strategy for excluding critical evidence during a trial for a department without a DEMS.
How do you prove your digital evidence has never changed or been altered? There are several ways to go about this, but one approach is through file hashing.
Hashing traditionally occurs as digital evidence is uploaded or ingested into the system. Your DEMS should be able to quickly generate a hash report for all of the digital evidence in a case. This report can be provided to the court and help prove the integrity of any files in question.
8. Accessible on mobile devices
Some DEMS solutions provide access to digital evidence via a mobile app or browser-based interface. Simply put, officers can upload or view digital evidence using their department-issued smartphones while in the field. Imagine your officers uploading digital photos directly from the scene or being able to quickly review surveillance video collected by another officer while making contact with a high-risk suspect in a case. Empowering officers with mobile-friendly access to the department’s DEMS saves time while potentially improving officer awareness and safety in the field.
9. Support for law enforcement evidence sharing
Sharing digital evidence securely with prosecutors, outside agencies and other critical stakeholders is a challenge for many police departments. This struggle is compounded as digital evidence continues to grow in size. Surveillance video that once was just a few megabytes is now many gigabytes in size. Copying digital evidence onto discs or thumb drives can be extremely time-consuming. Not only that, sharing evidence on loose media is insecure. Discs and thumb drives can be easily misplaced or mishandled and end up in the wrong hands.
Sharing critical digital evidence should be secure, uncomplicated and straightforward.
10. Support for citizen evidence sharing
Patrol officers face an increasing amount of digital evidence being shared by citizens in their community. As a result, many DEMS solutions have built-in citizen sharing features making it much easier for officers to quickly obtain and save digital evidence shared with them.
The most commonly shared evidence by citizens are smartphone images and videos; however, officers also routinely encounter text messages, voicemails, chats, emails, social media screenshots and virtually any other media you can imagine receiving on a smartphone. Without a DEMS, officers are stuck requesting citizens share digital evidence with them as email attachments or they may attempt to save it themselves in some way. Imagine the frustration of working with a citizen who isn’t very technical and attempting to walk them through sending you surveillance video (one-by-one) as email attachments. This scenario happens more often than you might think.
Sending digital evidence as email attachments is insecure and may be subject to public disclosure in some jurisdictions. Not only that, there’s a good chance that videos or images sent to officers by email or text message are reduced in size and quality by the mobile device.
Citizen sharing is a valuable feature to look for in a DEMS solution. With this, officers simply send a request via text message or email to the citizen with the digital evidence. Once the citizen receives the request, they upload the evidence directly to the police department’s evidence server from their smartphone. The DEMS seamlessly manages the entire transaction freeing officers to move onto other tasks. This can save an enormous amount of time and frustration in cases involving many witnesses. It also provides a complete chain-of-custody record for the evidence.
11. Manages all files types
Officers and detectives encounter a wide variety of proprietary and non-proprietary file formats including digital images, video, audio files, documents, text messages and emails. In some critical cases, detectives may generate proprietary crash data or unique computer and mobile forensic files stored in complex folder structures. Regardless of the file format or folder structure, all digital evidence generated in a case should be available to investigators and prosecutors in one place. A flexible DEMS solution can ingest and manage any file type while maintaining the original folder structure.
12. Advanced search and organization
As digital evidence is collected and uploaded in a case, investigators need search tools to quickly find and review the most important files. This is particularly crucial in serious, fast-moving cases.
Imagine a homicide investigation involving suspects fleeing in a vehicle through several busy city blocks. There are businesses and homes with CCTV systems along the entire escape route. Officers and detectives rapidly recover surveillance video from over 10 locations hoping to find a lead in the case; however, they know some of the video they recover will not be helpful. As they identify video clips of interest, they need to quickly separate and organize the most critical evidence in the case.
Most DEMS have comprehensive search and organizational functionality. This allows investigators to quickly find and separate the important evidence into virtual folders. For example, detectives may create folders containing surveillance video from specific locations and other folders containing still images of the suspects and getaway vehicles. Organizing digital evidence into virtual folders helps investigators, prosecutors, and other collaborators quickly locate the most important assets as a case is investigated and reviewed for charging.
13. Comprehensive review mode for investigators
After digital evidence has been uploaded, investigators need to be able to watch surveillance video and review digital images directly within the DEMS. Support for video playback and image review are fundamental to Digital Evidence Management Systems. Most DEMS also allow investigators to review documents and other non-proprietary file types without having to download a copy to examine outside the system.
Review mode within a DEMS should be easy to use while providing important information about the files being viewed. The system should catalog the date, time and users who have viewed, downloaded, printed, or shared the digital evidence being accessed. This becomes an audit record for chain-of-custody reporting.
14. Comprehensive reporting tools
As technology advances, digital multimedia also continues to grow in size and quality. Most police departments discover they are collecting increasingly more digital evidence (images, videos and other files) while also utilizing increased storage space (as files are getting progressively larger in size). To predict how much digital evidence storage an agency needs in the future, it must know how much is currently being stored as well as been ingested in previous years.
Most DEMS have comprehensive reporting features that can quickly determine how much digital evidence an agency has. A DEMS should be able to break down how much digital multimedia evidence was collected by week, month, and year and itemize the number of videos, images, documents, and other file types being stored. Comprehensive reporting tools allow police administrators to predict how much storage they will need in the future.
15. Support for image and video enhancement
Investigators routinely encounter poor-quality surveillance video and images. Camera placement and environmental factors significantly impact the quality of CCTV video. A frequent problem is dark and grainy CCTV recorded at night, making it difficult to identify suspects. In situations like this, investigators may need to lighten a video, crop an area of interest, and save a series of still images of a suspect. This form of enhancement is common in many investigations.
A DEMS with built-in enhancement capabilities allows investigators to improve video and images directly within the system. The DEMS should permanently preserve the original files when enhancements are performed by producing derivative copies. A DEMS is not a substitute for powerful forensic image and video enhancement software; however, support for performing basic enhancements can speed up the process of identifying suspects and producing attempt-to-locate bulletins.
16. Support for evidence purging
Digital evidence in cold or serious criminal cases are usually kept indefinitely, while evidence in many adjudicated cases will eventually need to be purged. Evidence retention is based on state and local guidelines and laws. Without a DEMS, agencies are left to comb through and purge digital evidence manually. Even for small agencies, this isn’t practical. Purging digital evidence by hand is also risky as it is relatively easy to inadvertently delete the wrong folders or files.
The DEMS should include evidence retention settings that can be set up to send reminders when digital evidence in a case is ready to be purged. Coordinate your DEMS retention settings with those of your physical evidence system, and your staff will be always be alerted when it’s time to purge all evidence in a case. Once it has been determined evidence in a case should be purged, the DEMS admin (or their designee) can initiate the purge and delete all the digital evidence associated with the closed case.
A DEMS can purge all the digital evidence in a case and the record of its existence or purge the digital evidence while retaining the record. Retaining the record allows records staff, evidence specialists, and investigators to search previously purged cases to see what digital evidence once existed while following local and state evidentiary retention guidelines.
What to expect in the future for DEMS solutions
Digital Evidence Management Systems are quickly becoming more sophisticated by tapping into cloud computing and deep learning technology. By utilizing cloud computing resources, a DEMS can automate redaction tasks (blurring faces, license plates, and RMS screens). There are also a variety of video analytic applications being pursued that help investigators analyze long segments of video by quickly identifying persons, vehicles, or objects of interest in a specific location or aid in tracking persons or objects through a series of video segments.
Proprietary CCTV video playback is also an ongoing challenge for many police departments. With thousands of proprietary surveillance video file formats, DEMS vendors are also looking for ways to automatically convert tricky video files into a non-proprietary format so that they can be played directly within the DEMS. Comprehensive support for proprietary video playback directly within a DEMS can significantly shorten the time it takes investigators to locate suspects or vehicles of interest in a case.
Resources
Finding a DEMS solution and adopting best practices for digital evidence handling can be overwhelming. It may be especially daunting if you manage a smaller agency and don’t consider yourself or anyone in your organization very technical. That’s OK! There are several resources available to get you pointed in the right direction.
- Scientific Working Group on Digital Evidence (SWDGE) regularly publishes best practices for handling and managing all types of digital evidence. Review their published documents for general guidance.
- Law Enforcement Video Association (LEVA) offers a variety of training in video recovery, analysis, comparison, report writing and courtroom testimony. As video evidence (CCTV, BWC, smartphone video, etc.) continues to grow each year, every police department should send at least one person to LEVA training.
I am also happy to assist. Feel free to contact me directly if you have questions or wish to discuss digital evidence handling and management.
