Mental Health of Digital Forensic Investigators

Transcript of interview with Paul Gullon-Scott

SKN

Hello everyone, this is Susanne Knabe-Nicol from Police Science Dr with an exclusive interview for the Police Science Dr Magazine. Today I'm speaking to Paul Gullon-Scott who's got a background in policing and specifically in digital forensics and we're going to talk about a very, very important topic - the mental health of the people who are doing the investigations in this field. Paul will tell you more about who he is, hello Paul, thanks for coming on today

PGS

Thanks for inviting me, it's nice to be here, it's nice to talk to you

SKN

Can you give us an overview of your policing background, your career, and your career since policing and what your particular interests are, please?

PGS

Yes, I spent um 30 years in policing, 14 of those years was as a digital forensic investigator, a job which I really enjoyed doing. Since then, I left digital forensics about two years ago and joined the NHS [National Health Service] as a higher assistant psychologist. I've always had an interest in the mental health effects of working as a digital forensic investigator and have been researching that area for approximately 10 years now and I continue to do so even though I've left the digital forensics industry.

SKN

Can you tell us what digital forensic investigation is, what do they do, because we're not talking about the people who hack into phones legitimately, we're talking about something different here, aren't we.

PGS

We are. Digital forensic investigators, in a nutshell are responsible for forensically recovering all data held on digital devices, for example mobile phones, computers tablets, anything that is capable of storing data, digital forensic investigators are responsible for recovering in a forensically sound manner for possibly using in court in the future.

SKN

And then the specific kind of investigations we're talking about here today is child abuse footage and images isn't it.

PGS

It is, indeed 90% of the work that I carried out as a digital forensic investigator was around child abuse investigations, which can be harrowing to see some of the material that's recovered.

PGS

I remember saying to you when we first spoke that I don't even want to see one single such image because it would be burnt onto my brain, somewhere onto my visual memory, and I wouldn't be able to figure out how to get it out of there, so it's a very difficult job. What is the kind of work that the investigators need to do, so we've got the categories and we've got the CAID [Child Abuse Image Database] database, can you give us a brief overview of those?

PGS

Part of the role of a digital forensic investigator when they're investigating child abuse cases is to categorise the images and movies which are recovered from the device being investigated. There are three categories, you've got category A, B and C, with A being the most serious, which is penetrative sexual activity with a child, and then you have B, which is non-penetrative, and C which is images of a child alone, posing naked. CAID is a national database which holds thousands and thousands, millions in fact, of hash values. A hash value is a digital fingerprint for an image or a video if you like, and it is unique to that particular image or video. Those hash values help digital forensic investigators to automatically categorise the images and movies as they're being read in from the suspect’s device

SKN

So, that means that those that are recognised don't then need to be reviewed by the investigator, which is good, but we we're dealing with large volumes nowadays. So, if a suspect gets arrested on suspicion of possessing, sharing, creating explicit images of children, then everything in the house is seized, that could be a phone, it could be USB devices, laptops, tablets all kinds of stuff, so there's so much footage, and we have so much storage capacity now, so this automatic categorisation with these hash values reduces that workload, which is really good. But you also told me about something that is already in legislation, where you looked up what the Crown Prosecution Service needs to actually prosecute and that realisation in itself can drastically reduce the amount of footage the investigators need to go through. Can you give us a summary of that?

PGS

The more we can work towards reducing the exposure to these images and videos, the less likely it is for a DFI [Digital Forensic Investigator] to become susceptible to the stressors which have been identified and are well recorded in research. So, the process that I brought into the force which I was working in at the time - during my research I discovered that the CPS actually place a threshold on the number of images that they then consider a ‘large collection’, and once this threshold is met, then the sentencing guidelines are open to the presiding judge in the case. So I discovered that the CPS consider a large collection either 250 category A images and movies combined, or a thousand of the combined categories, so that's a thousand images and images or videos are combined across the three categories A, B and C. Now, when I discovered this, I asked myself the question ‘Why are we categorising thousands, sometimes tens of thousands of images and videos, why are we being exposed to all of this material?’

So, I took this to my then digital forensics manager and we approached the local CPS and the CPS agreed that we could categorise up to the threshold and then add a caveat in the streamlined report to explain the number of images that weren't actually categorised. But I also realised, by combining the use of CAID and the thresholds which the CPS are guided by, quite often the thresholds would be met by CAID reading in the known images and videos. So, I sat back and thought about this for a while and I thought, if we introduced a victim ID search for unknown first generation images, images which are not known to CAID, by combining the use of CAID, by combining the victim ID search and by adopting the CPS thresholds, the reduction and exposure to child abuse material was huge. It didn't only reduce the exposure to the indecent material, what it also did was speed up the investigation process around child abuse investigations. It had a double wammy effect if you like.  And of course, by reducing exposure, you're increasing resilience of the investigator and reducing the chance of them becoming susceptible to the stresses. And the stressors I should mention are post-traumatic stress, depression, anxiety and burnout, and they are well recorded and well supported, there's a lot of evidence that those stressors are what DFIs become susceptible to.

SKN

So, even though you have identified that by combining the database that already recognises a lot of images and actually only in searching through up until you've reached a threshold for charging to reduce exposure of investigators to these images and these videos, but also there's a safeguard in there that you're not going to miss anything that might be a first generation image, which means it's actually new footage of he maybe the person who owned the device generating new footage which means that a new victimisation of something, so that's very important to mention, that the safeguard is there. Let's talk about the mental health now of these investigators I said to you I wouldn't even want to see one - these guys are dealing with thousands and thousands, and you've mentioned the kind of symptoms that they can have. How far reaching is that, and how much of a problem is that, we are talking about the UK at the moment, but obviously this will affect every other country as well where they do this work.

PGS

Absolutely it does. I know the problems experienced here in the UK are experienced internationally I now speak with various researchers in this area. I've made a very good contact in America and we have chats about what we're currently working on. In the UK. I can say with certainty it's a national problem because I carried out a national survey of DFIs about two years ago, which formed part of my thesis and I've since published a paper from that, so yes, it is a national problem.

SKN

Do you have any figures available to maybe describe the rate of attrition in this job, the mental and physical health rates, any absences - can we quantify that problem somehow?

PGS

I've tried to do that I have submitted Freedom of Information Act requests to forces across the country, those must have been about October last year [2024], as yet I've had one or two responses who have responded saying that they will not provide that information.

SKN

That's interesting, what was their reasoning for that?

PGS

‘Personal data’ is what they quoted.

SKN

It wouldn't really be personal data if you're just asking for the figures but – okay.

PGS

I don't think it would be either.

SKN

Let's leave that point there. So, you have a good idea of how we can actually deal with this problem. You mentioned last time we spoke that you know there is an annual remote PTSD – post-traumatic stress disorder assessment which is just not sufficient and you are proposing a framework for what to do to maintain the well-being and the efficiency of those digital forensic investigators, can you talk us through that framework, what is it that you're proposing?

PGS

Well the framework consists of three things really, the grading policy which I've spoken about. The well-being framework also has several risk management recommendations and those consist of pre-employment screening, not to rule people out from doing this job, it's to mainly to establish a baseline using validated psychometric instruments to establish where they are at the point of entry of employment. Those same measurements could then be done biannually and compared to the baseline to see if there's any increase in reported symptoms. Because if there is, we all know the sooner an intervention is applied to a mental health problem, the easier it is to rectify, whereas if we wait until the cracks begin to show, it's too late. Chances are that individual, that investigator is be is going to become unwell and may require taking time off from work.

That touches on the next point, which is compulsory and regular mental health assessments. I know in most forces the mental health assessment only happens annually, so at once every 12 months, I suggest that should be done every six months in order to identify at the earliest opportunity any investigator who has increased scores. It should always be compared to the previous test obviously to identify that increase. And feedback, this is something found out through research, feedback should always be given, not just to the workplace but also to the investigator. More often than not I've found that the investigator actually doesn't get any direct feedback from those psychometric assessments. It's only sent to the employer, which I find very strange, because if you make the investigator aware, then they themselves can take steps to take care of themselves.

Adequate training is another big factor, I've spoken to many DFIs who state they don't receive adequate training on the tools and the software that they're using. Someone is usually sent on the course, they come back from the course and cascade that training down, which sometimes doesn't give an adequate understanding of the software being used from the person cascading it, because they're not trained as a trainer.

Management of workload is a big one, many DFIs juggle multiple cases at any one time and if you are doing say 10, 20, 30 child abuse investigations, it is going to have an impact at some point. Management of workload could include taking a break from child abuse investigations and doing something else, such as say a fraud investigation which gives the DFI a chance to decompress whilst they're doing that work. It looks at the grading of images, I have already talked about the grading policy which I suggested and brought in while will worked as a DFI.

And something that never happens are regular team talks or chances to have reflective sessions after cases. Having that time to talk within the team is really important because your team members are all exposed to the same thing you are. And they will absolutely understand what you're talking about and because it's within the team, it would build team cohesion and they would be more likely to support you because they understand what you're going through. And quite often, because of the security of the work that you're doing, you as an individual cannot go out of work, go home for example and turn around to your partner and say ‘This is what I've been exposed to today’, because you run the risk of vicariously traumatising them. And more often than not as a DFI, personally speaking I certainly never ever did that, because I didn't want my family, my wife etc. to know what I was looking at at work. There's a little bit of stigma attached to it from within you as a person.

So, the framework basically consists of the risk management recommendations, the grading policy, and a booklet which I also produced, and the booklet discusses the stressors in detail, it discusses what they look like, what the signs and symptoms are, and I produced that for two reasons. Not only for the individual to become aware of the stresses themselves but also become aware of them in other people. Because when they do start to affect you, you don't always see them in yourself. But a colleague working next to you 5 days a week would be more likely to see the changes as a result of the stresses. And they themselves could notify the management who can then introduce interventions.

To summarise, it's basically three documents: risk assessments, grading policy and the booklet which were all introduced where I used to work.

SKN

Are you now advocating that as part of your of a freelance role because I've got your website address here [www.spectrumspecialistconsultancy.com], tell us about this consultancy, what are you doing there what are you offering?

PGS

Through Spectrum Specialist Consultancy what I've begun to offer is a tailored framework, similar to what I produced for my previous employment, and I've started to do that for a number of digital forensic companies now. What I'm also beginning to develop is the provision of mental health support, because currently I believe it isn't quite done correctly, it's quite often a reactive service that DFIs are directed to, so at the point the cracks begin to show, the DFIs are sent to the Occupational Health Unit, which in my opinion is too late, because the intervention will take much longer to assist the DFI. The viewpoint that we’re taking is from a very proactive point of view, so yes, it will contain screening measures, they will be done every 3 months as opposed to annually to identify any increases in reported symptoms. There will be a monthly reflect-session held with a qualified psychologist who will use that session to provide psycho-education around stresses but also it gives the DFIs a chance to reflect on the cases that they're working on or any stresses that they currently have and talk those over with a qualified specialist. And if interventions are required, those specialists are trained to deliver cognitive behavioural therapy or EMDR [eye movement desensitisation and reprocessing] therapy, which research has proven are able to reduce the stresses available. And we've just begun to put this together and put it out as a service via Spectrum.

SKN

You mentioned that you worked for the police and that you not work for the National Health Service, but you've got two masters in Psychology and you're doing a doctorate at the moment as well, aren't you?

PGS

I actually have four degrees in total, I have an undergraduate degree in software engineering, a Master of Arts in Fraud and Financial Investigations, I have a Master of Science in general psychology and a second Master of Science in Forensic Psychology, and I'm hoping to start the doctorate later this year [2025].

SKN

So, quite qualified to be doing all this work, fantastic. Where do you think might be the challenges with being able to implement this? Obviously, you're advocating that private companies use that and police forces as well, do you think that's going to be easy / difficult and why?

PGS

I think the framework in itself is easy to introduce into any workplace, whether it be private or public. When it comes down to the provision of mental health services, I personally feel it's down to cost: what are employers willing to pay to protect their employees and it's sad to think that it actually comes down to cost when you consider the value of an employee. You're talking about a highly, highly skilled individual who might have worked in the industry for quite some time and has gained an awful lot of experience and knowledge in doing this role. And to me it doesn't make sense to not invest in mental health provision for DFIs, because if they do become unwell. It isn't just the individual you're losing, it is the years of experience and skill and knowledge that also go with that person and that takes a long time to recover from as an employer.

SKN

That's always the challenge - who's going to pay for it - even though it's so clear how much investment you've already put into that person and what you're losing, and still people don't see the long-term benefit of something that they have to pay for in the short term. You also wanted to mention a conference that might be of interest to our viewers, so please do that.

PGS

I am busy working with other partners, other people who I collaborate with in the industry around researching the mental health effects of working as a DFI, and there are three of us who have come together as a symposium which is going to be submitted to the Division Of Forensic Psychology Conference which happens in Glasgow in July [2025], so we are putting together a submission to hold the symposium within the conference in Glasgow. If it does get accepted and anyone who is attending the conference would like to come and talk to us or listen to us speak, then please do so we would love to see you.

SKN

I managed in the background to quickly get that link up there for you so people can see it if they want. My last question to you today, Paul is, if you had a magic wand and you could wave it and make one change in the field that we've been talking to each other about today, what would that one change be?

PGS

For me, that that one change would be reducing exposure to child abuse images or other imagery which is very disturbing, such as terrorism imagery for example. And I would do that using something along the lines of the grading policy which I brought into my previous employment. Sadly, that is not a mandated change, and until it becomes a mandated change, not every force in the country uses it or will use it. So, until the powers that be look at it and decide - this is a really great idea, let's make that mandated change - it's down to individual digital forensic unit managers to make that change, to introduce it. So, if I could change one thing that's what I would do because it would reduce the level the level of exposure of DFIs, increase their resilience and of course decrease the time it takes to carry out such investigations

SKN

Paul Gullon-Scott, thank you very much for your time today