Producing evidence that can be used in court is a central goal of criminal investigations. Forensic science focuses with considerable success on the production of pieces of evidence from specific sources. However, less is known about how a team of investigating police officers progressively produces a body of evidence during the course of a criminal investigation. This literature review uses Weickian sensemaking to analyse what is known about this process in criminal investigations into organised crime. Focusing on the criminal investigation team, collective sensemaking is used as a lens through which to place the reasoning processes used in constructing evidence in a social context. In addition to describing three constituent parts of collective sensemaking relevant for criminal investigations, six factors are identified that influence the quality of collective sensemaking. Building on these results, nine focal points are presented for analysing the sensemaking processes in a criminal investigation team, aimed at advancing knowledge about the production of evidence in criminal investigations of organised crime. Furthermore, a definition of evidence is developed that is suitable for studying sensemaking in the context of an ongoing criminal investigation.
There appears to be some hesitation within the forensic biology community to formally evaluate and report on findings given activity level propositions. This hesitance in part stems from concerns about the lack of relevant data on the dynamics of biological traces and doubt about the relevance of such expert opinions to the trier of fact. At the Netherlands Forensic Institute formal evaluative opinions on the probability of case findings given propositions at the activity level are provided since 2013, if requested by a mandating authority. In this study we share the results from a retrospective analysis of 74 of such requests. We explore which party initiates requests, the types of cases that are submitted, the sources of data being used to assign probabilities to DNA transfer, persistence, prevalence and recovery (TPPR) events, the conclusions that were drawn by the scientists, and how the conclusions were used by the courts. This retrospective analysis of cases demonstrates that published sources of data are generally available and can be used to address DNA TPPR events in most cases, although significant gaps still remain. The study furthermore shows that reporting on forensic biology findings given activity level propositions has been generally accepted by the district and appeal courts, as well as the other parties in the criminal justice system in the Netherlands.
Prior research on network attacks is predominantly technical, yet little is known about behavioral patterns of attackers inside computer systems. This study adopts a criminological perspective to examine these patterns, with a particular focus on data thieves targeting organizational networks. By conducting interviews with cybersecurity experts and applying crime script analysis, we developed a comprehensive script that describes the typical progression of attackers through organizational systems and networks in order to eventually steal data. This script integrates phases identified in previous academic literature and expert-defined phases that resemble phases from industry threat models. However, in contrast to prior cybercrime scripts and industry threat models, we did not only identify sequential phases, but also illustrate the circular nature of network attacks. This finding challenges traditional perceptions of crime as a linear process. In addition, our findings underscore the importance of considering both successful and failed attacks in cybercrime research to develop more effective cybersecurity strategies.
MULTIFILE
