In a world where law and sociology evolve hand in hand, a new frontier is emerging in the form of digital criminology. As a dynamic offshoot of sociology, this emerging discipline reflects the profound impact of technology on the landscape of criminology.

Professor Anastasia Powell, in her book (Digital Criminology) co-authored with Gregory Stratton and Robin Cameron define digital criminology as an ‘intersection of critical, cultural, and socio-technical theory and research’. Likewise, the law is responding to emerging technology, especially artificial intelligence through legislative and administrative measures. On 15 December 2023, the European Artificial Intelligence Act was passed by the European Parliament. Similarly, in Pakistan, the Computer Emergency Response Team Rules, 2023 (CERT Rules) under section 49 read with section 51 of the Prevention of Electronic Crimes Act, 2016 (PECA) were passed. On the data front, the draft data protection law by the Ministry of Information and Technology has been prepared and is pending consideration for legislation. In policing, data analytics will be used proactively as many new pieces of legislation contain provisions for data collection, retention and lawful use. For example, the Anti-Rape (Sex Offenders Register) Rules, 2023 under section 24 of the Anti-Rape (Investigation and Trial) Act, 2021 obliges the state to collect data about sex offenders. Similar provisions are available now for trafficking in persons and for migrants’ smuggling related offences in Pakistan. In this background, there is need to study how different technologies are shaping state and law enforcement responses. One area of particular interest is the use of digital forensics in criminal prosecutions. This article seeks to explore the concept and will analyze its integration with the criminal justice system along with some recommendations.

Defining Digital Forensics

Several terms, such as computer forensics, electronic forensics, and digital forensics, are often used interchangeably, raising the question of whether they are synonymous or distinct. Professor Thomas J. Holt, in his book “Cybercrime and Digital Forensics: An Introduction,” clarifies this by differentiating computer forensics from digital forensics. He describes computer forensics as the investigation and analysis of digital media for legal evidence, traditionally focusing on inactive computer components (termed “dead box forensics”). In contrast, digital forensics is broader, encompassing the analysis of a wide range of digital evidence, including network, computer, mobile device, and malware forensics. This evolution signifies that digital forensics, covering a comprehensive range of digital devices, is the more encompassing term in contemporary discourse.

Digital Forensics And Criminal Investigations

Initially, when the Prevention of Electronic Crimes Act (PECA) was enacted in 2016, only the Federal Investigation Agency (FIA) was authorized to probe electronic crimes. However, recognizing the widespread presence of digital evidence in diverse crimes, the Criminal Laws (Amendment) Act of 2023 expanded this authority. Now, provincial police can also register cases related to these offences under PECA. This change reflects the increasing relevance of digital evidence in modern criminal cases. The 2023 amendments have also introduced new offences under PECA, specifically under sections 22-A, 22-B, 22-C, and 24-A, covering crimes like online grooming, cyber incitement, and child exploitation. In addition, incitement to terrorism/extremism, communication for money laundering and financing for terrorism through emerging technologies like crypto-currency and smart contracts primarily depend on electronic means that invariably call for collection, preservation and processing of digital evidence through digital forensics.

Analysis & Recommendations

Recent legal developments and field observations underscore the need to prioritize digital forensics within the mainstream criminal justice process in Pakistan. Considering its growing importance, several key points emerge:

1. Crime scene inspection and role of first police responder are regulated by Chapter XXV of the Police Rules, 1934. This chapter will have to be re-written to include and allow for the concepts of first responder for digital evidence and for crime scene investigation imagining the role of dedicated officers with technical/digital capacities. Presently, it is being practiced in some districts and by select officers; for want of an updated and comprehensive legal framework, the initiatives are often challenged by defense lawyers. In order to provide legality to all police and prosecution actions vis-à-vis digital evidence, there is a strong need to redraft the Chapter XXV to cater for electronic and digital evidence;
   
2. The police and prosecution must be trained to collect, preserve and present digital evidence in a court of law by including dedicated modules in their training programmes on digital forensics;
   
3. For prevention of crimes, police are using data that they collect and maintain for the Criminal Record Office (CRO) and the data and videos that they get from the safe city systems’ cameras. They identify hotspots and try to develop indigenous capacity for facial recognitions. The use of these technologies for predictive policing must be put under some sort of oversight mechanism and should also be properly legislated upon to strike necessary balance between security and privacy;
   
4. There is a strong case for national and international cooperation for digital forensics as it often involves non-localized servers and cross-border intermediaries. This national and international cooperation is very bureaucratic and is subject to the rules of business of the federal and provincial governments and to the Mutual Legal Assistance (Criminal Matters) Act, 2020. The Mutual Legal Assistance Act itself is a nascent legislation and requires operationalization through subordinate legislation and focused capacity building of stakeholders;
   
5. Accreditation and standardization of digital forensic labs in the country is a must. Unlike the forensic science agencies in the provinces that have a legal framework and are part of international accreditation systems, the digital/IT labs need to be brought under some sort of standardization regime. An added advantage of this accreditation will be that the digital forensics’ experts would be declared as experts under article 59 of the Qanoon-e-Shahadat Order, 1984 (law of evidence; hereinafter referred to as QSO); this legal device will be useful in shielding the appearance of experts in courts unnecessarily;
   
6. The admissibility of electronic/digital evidence has long been permitted under article 164 of the QSO. Recently, the scope of the article was expanded to include social media applications like WhatsApp, Facebook, Skype by rewriting the article 164 of the QSO through section 12 of the Criminal Laws (Amendment) Act, 2023. There is, however, need to improve the weightage of digital evidence, which is still treated, at best, as secondary in nature;
   
7. The preservation and storage of digital evidence as case property of criminal cases requires amendments in Chapter XVII of the Police Rules, 1934 that regulates the record maintenance and chain of custody system in the criminal justice system. The digital media and forensic reports emanating out of these are to be handled professionally and all possibilities of editing/manipulation/deep fakes have to be ruled out;
   
8. Other investigation agencies like the Anti-Narcotics Force, the National Accountability Bureau, the Pakistan Customs (while investigating smuggling related offences) and the provincial departments vested with lawful coercive powers must be trained in digital forensics;
   
9. Better capacity of organizing digital forensics in criminal cases is likely to be of universal value for Pakistan as cross-border and cross-jurisdictional transmission of evidence will be easy, especially in terrorism cases;
   
10. Finally, the cybersecurity mechanisms must be integrated with the criminal justice processes. The latest CERT Rules are only focused on the preventive cybersecurity paradigm; the detective and restitution driven aspects must be incorporated into the CERT Rules and seizure of property acquired through electronic processes like e-banking, virtual assets and smart contracts must be added to the tools available to the law enforcement apparatus and for cross-border/international communication and cooperation.

These points are not exhaustive by any means but aim to provide a point of departure for further work in this area. A significant gap remains in the local measurement and tracking of cybercrime and related incidents, as there currently exists no centralized system for comprehensively addressing these issues.

Centre for Criminal Justice Sector Reform & Capacity Building (C3) blog