By Jon Fowler, Managing Director, Data Solutions at Secretariat
The ongoing Post Office Horizon Inquiry stands as a landmark case that showcases the power of modern digital forensics in answering a critical question: Who knew what and when? At the heart of the inquiry lies the fundamental need to understand if and at what point senior Post Office officials became aware of the flaws within the Horizon IT system.
Traditionally, digital forensics has focused on proving digital events – a website visit, a file modification, or a device connection. While it excels at establishing “what happened,” it does not definitively answer “who did it?” This is where eDiscovery and communication analysis comes in, bridging the gap between digital activity and human involvement. Techniques like communications mapping visualize communication networks, a cornerstone of modern eDiscovery. Creating a diagram where nodes represent individuals and connections signify email exchanges. This means investigators can track conversation threads, identify key participants, and potentially reveal who knew what and when.
Another crucial aspect in the Horizon case is digital forensics’ ability to recover deleted communications. Deleted emails may not be truly gone—their remnants might linger within an organization’s storage systems. So, understanding the organization’s archive and storage policies becomes critical. Retention schedules and backup procedures can prove invaluable in retrieving deleted emails, potentially revealing previously lost or, in some cases, allegedly hidden knowledge trails.
In essence, digital forensics goes beyond proving actions when combined with eDiscovery and communication analysis. It helps establish “who knew what, when” by illuminating the flow of information and potentially identifying those with access to specific knowledge at given points in time.
Dissecting Communication with Forensics
Digital forensics and eDiscovery play a much broader role than proving technical issues within Horizon. While it can readily confirm system malfunctions and data discrepancies, it’s through email and communication analysis that the human element comes to light. Techniques like communication mapping become central to the investigation.
By meticulously analysing email exchanges between Post Office staff, investigators can visualize the flow of information regarding Horizon’s problems, which allows them to identify key figures involved in discussions about the system’s issues. Following these communication threads, they can track the dissemination of information and pinpoint when senior management became aware of the problems.
Unearthing Deleted Knowledge
The ability to recover deleted emails holds immense significance in the Horizon inquiry. Allegations abound that somebody deliberately deleted emails crucial to understanding the timeline of knowledge. However, this is where digital forensics expertise becomes critical.
Were these deleted emails to exist, investigators may be able to recover them by scrutinizing the Post Office’s email archiving and storage practices. Any such communications could reveal discussions between staff regarding Horizon’s issues, shedding light on when and how knowledge of the systems flaws spread within the organization.
Expanding the Scope Beyond Emails
The digital forensics toolkit extends well beyond email analysis. We can use techniques like user activity monitoring (UAM) to reveal if and when senior officials accessed specific documents or reports related to Horizon’s problems. Did they access these documents? If they did, when? This level of information can provide valuable insight into their level of awareness. Furthermore, metadata analysis of relevant files can unearth crucial details. For example, the creation date of documents detailing potential system flaws can be examined, as can analysing who created these documents and when, so the inquiry can establish a timeline of when knowledge about the system’s issues may have surfaced within the organization.
Challenges and Considerations
While digital forensics presents a powerful tool, the Horizon inquiry highlights several key challenges. Data retention policies may limit the recoverability of deleted emails, while access to UAM data may be subject to privacy restrictions. Careful consideration must be given to legal and ethical implications throughout the investigation.
It is crucial to remember that digital forensics alone cannot definitively prove knowledge. Emails can be forwarded, documents shared, and ambiguity might exist within communications. Expert legal analysis is necessary to interpret the vast amount of data gleaned from digital forensics. Only then can a compelling case be built around when specific knowledge reaches senior management.
The Post Office Horizon Inquiry is a powerful testament to eDiscovery and digital forensics’ critical role in understanding information flow within an organization. By combining communication mapping with data recovery and advanced techniques, investigators can illuminate the chain of knowledge and establish when specific individuals may have become aware of crucial information. While challenges exist, digital forensics is essential in uncovering the truth within complex investigations, ensuring justice can be served.
Jon Fowler is managing director of data solutions at disputes and data advisory company Secretariat. He is an eDiscovery and digital forensic expert with a particular focus on financial regulatory investigations and large-scale complex litigation.