Law Enforcement Investigations Research Articles

Identifying offenders on Twitter: A law enforcement practitioner guide

Twitter remains one of the most popular social media network sites in use today and continues to attract criticism over the volume of unsavoury and illegal content circulated by its users. When breaches of legislation occur, appropriate officials are left with the task of identifying and apprehending the physical user of an offending account, which is not always a simple task. This article provides a law enforcement practitioner focused analysis of the Twitter platform and associated services for the purposes of offender identification. Using our bespoke message harvesting tool ‘Twitterstream’, an analysis of the data available via Twitter's Streaming and REST APIs are presented, along with the message metadata which can be gleaned. The process of identifying those behind offending Twitter accounts is discussed in line with available API content and current Twitter data retention policies in order to support law enforcement investigations surrounding this social media platform.

Validation and implementation of the Investigator® 24plex QS kit for forensic casework

Advanced commercial STR multiplex systems containing the expanded CODIS core loci have been developed to achieve robust results for a wide range of inhibited and degraded forensic samples. To address these requirements and challenges, the new Investigator® 24plex QS kit (QIAGEN) was evaluated in this study which coamplifies all 23 recommended markers using 6-dye technology and incorporates an innovative internal control, the Quality Sensor (QS). The Quality Sensor, containing resultant alleles “Q” and “S”, which is unique and patent pending, allows differentiation between robust amplification, degradation, inhibition, lack of amplification of DNA and failed PCR amplification. The performance of the Investigator® 24plex QS kit was evaluated using various sample types, a total of 130 samples from 25 forensic caseworks commonly encountered in our forensic laboratory during law enforcement investigation (homicide, sexual assault, robberies, criminal possession of a firearm, possession of a controlled substance, and property crimes-burglaries). The data indicates that the Investigator® 24plex QS kit produces an excellent “First Pass Success Rate” (full profile obtained with one amplification and one CE injection) with conclusive and reliable profiles, even when amplifying degraded or inhibited samples. Based on the results of this study, Investigator® 24plex QS Kit is rapid, achieves optimal results with difficult casework evidence samples and increases the detection of a minor contributor in mixtures. As an additional benefit, it improves the laboratory workflow due to the additional information given by the “Quality Sensor” and assists forensic experts in the selection of the most appropriate rework strategy.

A South African perspective on mutual legal assistance and extradition in a globalized world

This contribution focuses on the modalities of mutual legal assistance and extradition from a South African perspective. The question is posed whether South Africa has succeeded to establish the required framework as a fully fledged member of the international community to make a positive contribution in the fields of mutual legal assistance and extradition subsequent to its international political isolation during the apartheid era. Although the international community derives substantial benefit from a borderless global world, it has as a result also to deal with the negative impact of globalization on international crime. Physical and/or electronic crimes are increasingly committed across borders and may be described as borderless, but law enforcement (combating, investigation and prosecution of crime) is still very much confined to the borders of a state. Criminal networks have taken advantage of the opportunities resulting from the dramatic changes in world politics, business, technology, communications and the explosion in international travel and effectively utilize these opportunities to avoid and hamper law enforcement investigations. As a sovereign state has control over its own territory it also implies that states should not interfere with each other’s domestic affairs. The correct and acceptable procedure would be for a state (requesting state) to apply to another state (requested state) for co-operation in the form of mutual legal assistance regarding the gathering of evidence and/or extradition of the perpetrator. Co-operation between states are governed by public international law between the requesting and requested state and the domestic law of the requested state. The South African legislature has increasingly provided for extraterritorial jurisdiction of South African courts in respect of organized crime and terrorism. It does however appear that existing criminal justice responses are experiencing challenges to meet the demands of sophisticated international criminal conduct. Mutual legal assistance and extradition provisions may show that the world is becoming smaller for fugitives and criminals, but the processes are far from expeditious and seamless. An overview of the South African law pertaining to mutual legal assistance and extradition indicates that the South African legislative framework and policies as well as international treaties make sufficient provision to render international assistance in respect of mutual legal assistance and extradition. The role of the courts in upholding the rule of law and protecting the constitutionally enshrined bill of rights, is indicative of the important function that the judiciary fulfills in this regard. It is important that extradition is not only seen as the function of the executive as it also involves the judiciary. It appears that South Africa has displayed the necessary commitment to normalize its international position since 1994 and to fulfill its obligations in a globalized world by reaching across borders in an attempt to address international criminal conduct.
 

Police interpreting: The facts sheet

AbstractInterpreting for the police is the backbone of legal interpreting. Yet it is grossly overshadowed by the more visible and more public court interpreting. This paper describes the setting of police interpreting, highlighting some of the major issues and challenges in the field that place a lot more than linguistic pressure on the interpreter. It examines the task of interpreters working within the Australian police setting and casts light on three prevailing practices that tend to challenge the interpreter. The practices relate to the selection, briefing, and training of interpreters working for law enforcement investigations. The paper argues that the current training, instructions, and perception of the role of the police interpreter are inadequate. It further argues that for police interpreting to become professional, formal training in the context of police investigations and pre-committal proceedings is required.

A systems approach to forensic science applied in the military domain

Forensic science is undertaken in support of law enforcement investigations, criminal justice prosecutions, intelligence, and military objectives. There are different forensic operating models to meet these various objectives and no unified approach to forensic science has been described. There are common challenges in the military domain, which impacts the delivery of forensic science, including: different terminology between organizations, complex operating environments, operating siloes, inward-looking military structures, quality management, and resource constraints. One solution to these challenges is to apply modern organizational theory to military-focused forensic science. Organizational theory is the study of organizations in a structural sense, including objectives, people, structure and management. The modern organizational theory systems approach describes how organizations should be viewed as systems within larger systems. In the work presented in this paper, a systems approach has been applied, for the first time, to military forensic exploitation to address the common issues faced by military organizations. The advantages of applying a systems approach to military forensic exploitation are that it is applicable across forensic science organizations, it is flexible and scalable to meet the changing external environment, and it articulates the redundancies in the system to help address system failures.

Automated Facial Recognition Technology: Recent Developments and Approaches to Oversight

Introduction There has been a rapid expansion in the type and volume of information collected for security purposes following the terrorist attacks on the United States of America (‘US’) on 11 September 2001. This event has been described as precipitating a program of ‘globalized surveillance’. New technology, biometric identification and other developments such as metadata retention can provide governments with an increasingly comprehensive picture of citizens’ lives. This has resulted in a rapidly expanding use of human biometric information in law enforcement investigations and other applications. The first part of this article describes Automated Facial Recognition Technology (‘AFRT’) and its law enforcement and border security applications, as well as integration with image sources such as closed circuit television (‘CCTV’), social media and big data. Recent developments including biometric identification documents (licences and passports) and information sharing arrangements that promote searching between state, territory and national government databases to facilitate a national facial recognition system will be discussed. These developments are reviewed against the backdrop of tension between individual privacy rights and collective security objectives. The second part of the article examines existing privacy protections, law enforcement exemptions, and regulatory options based on an international review of current oversight models. As is often the case in relation to technological advancements, government regulation and the legal system have lagged behind, and potential regulatory approaches have not been adequately discussed in either public debate or the academic literature. In the absence of a constitutional bill of rights or a cause of action for serious invasion of privacy in Australia, there are limited protections in relation to biometric information, and those that do exist, such as protections provided by the Privacy Act 1988 (Cth), are subject to exemptions. This has led to a significant governance gap. In order to align with international regulatory practices, the functions and funding of the Office of the Australian Information Commissioner (‘OAIC’) should be strengthened or, alternatively, a Biometrics Commissioner should be introduced.

Enlarged subarachnoid spaces and intracranial hemorrhage in children with accidental head trauma.

OBJECTIVE Benign external hydrocephalus (BEH) is an enlargement of the subarachnoid spaces (SASs) that can be seen in young children. It is controversial whether children with BEH are predisposed to developing subdural hemorrhage (SDH) with or without trauma. This issue is clinically relevant as a finding of unexplained SDH raises concerns about child abuse and often prompts child protection and law enforcement investigations. METHODS This retrospective study included children (1-24 months of age) who underwent head CT scanning after an accidental fall of less than 6 feet. Head CT scans were reviewed, cranial findings were documented, and the SAS was measured and qualitatively evaluated. Enlarged SAS was defined as an extraaxial space (EAS) greater than 4 mm on CT scans. Clinical measurements of head circumference (HC) were noted, and the head circumference percentile was calculated. The relationship between enlarged SAS and HC percentile, and enlarged SAS and intracranial hemorrhage (ICH), were investigated using bivariate analysis. RESULTS Of the 110 children included in this sample, 23 had EASs greater than 4 mm. The mean patient age was 6.8 months (median 6.0 months). Thirty-four patients (30.9%) had ICHs, including subarachnoid/subpial (6.2%), subdural (6.2%), epidural (5.0%), and unspecified extraaxial hemorrhage (16.5%). Enlarged SAS was positively associated with subarachnoid/subpial hemorrhage; there was no association between enlarged SASs and either SDH or epidural hemorrhage. A larger SAS was positively associated with larger HC percentile; however, HC percentile was not independently associated with ICH. CONCLUSIONS Enlarged SAS was not associated with SDH, but was associated with other ICHs. The authors' findings do not support the theory that BEH predisposes children to SDH with minor accidental trauma.

Fraud detection suicide: the dark side of white-collar crime

PurposeThe purpose of this paper is to explore the issue of suicide, a violent act against one’s self, as it relates to white- and red-collar crimes. White-collar crime can be described as nonviolent crime committed for financial gain. Red-collar crime describes a situation where a white-collar criminal commits an act of violence, often murder, to silence someone who is in a position to report a fraud they have perpetrated. Previous research has not addressed the issue of suicide, as it relates to white- and red-collar crime.Design/methodology/approachThe analysis is conceptual, focusing on the historical underpinnings of white- and red-collar crime and reviewing the evolution of white-collar criminals. Sources of information consisted of published news media, scholarly articles and articles retrieved from the web.FindingsA suicide may be linked, directly or indirectly, to a financial crime. Law enforcement must be careful not to jump to conclusions, as there is a possibility that a staged suicide has occurred.Originality/valueLaw enforcement individuals may want to consider an additional motive when investigating a suicide, especially when the victim has some type of connection to a known fraud. This type of connection may not be readily apparent and may require a new approach on the part of a law enforcement investigation.

The Role of the Anthropologist in the Application of NamUs.

The National Missing and Unidentified Person System (NamUs) provides a web-based platform where forensic scientists, law enforcement investigators, and the public can share information related to missing person and unidentified decedent cases across the United States. Through this secure online database, forensic anthropologists, along with medical examiners, coroners, law enforcement officers, family members of missing persons, and concerned citizens, can access varying levels of information on a common platform to assist in the resolution of these cases. Conventional wisdom and experience allows that an individual who is known within the community and has been dead a very short time is more likely to be identified than someone who is badly decomposed and/or skeletal. For others, even when there has been an extended postmortem interval, circumstances, associated evidence, and location of the remains are just some of the elements that direct the investigation and help establish the identity of the decedent. When the remains are degraded by factors such as extended postmortem interval, mechanical disruption, scattering, or burning, however, the identification becomes much more difficult. In the first week of May 2016, there were 10 767 open cases of unidentified remains in NamUs. Of these, 7257 were classified as unrecognizable by a variety of aforementioned factors. By the very nature of their work, anthropologists can develop key pieces of information from decomposed and/or skeletal elements and NamUs can provide the technology to consolidate and share their findings as well as those of all subject matter experts involved with the investigation.

Private Searches in the Age of Big Data

Dragnet surveillance is the bogeyman of Fourth Amendment law. But in today’s world, much dragnet surveillance — particularly related to data — is spearheaded by private actors, who increasingly perform the “first line of offense” in law enforcement investigation. As policing becomes more dependent on data and algorithms, this trend is only likely to intensify. Should private surveillance be categorically off-limits to Fourth Amendment scrutiny? Construed at face value, existing law appears to say yes. That answer, however, is both normatively and doctrinally implausible. In a world of “big data policing,” the Fourth Amendment’s state action requirement must be relaxed. The doctrinal test should focus on the functional role that private actors play in investigations — whether the private actor has effectively displaced, and come to substitute for, law enforcement labor — not on formalities of public and private. In fact, current doctrine already invites a distinction along these lines, though it has been sidelined in favor of a wooden “state agency” test. Once the Supreme Court’s private search canon is reconstructed, however, it becomes clear that the salient question — in both a descriptive and a normative sense — is whether law enforcement has been outsourced, not the precise legal relationship between private actors and law enforcement officials. One aspect of the question, instructive though not necessarily exhaustive, is whether the initial (private) surveillance has a dragnet character or not.

Cosa Nostra and Camorra: illegal activities and organisational structures

This article intends to develop an introductory reflection concerning the most recent trends of two of the major Italian mafia organisations: the Sicilian Cosa Nostra and the Campanian Camorra. Following a comparative perspective, the analysis will focus the attention on changes that have occurred in recent years both at the level of illegal activities and at the level of organisational structures. After the bombs of the nineties, Cosa Nostra has moved towards a flexible and less centralised organisation, investing dirty money in the legal economic sector, to reduce its exposure to law enforcement investigations. At the same time, the Camorra clans have considerably widened their range of activity both at a local and international level.

Stakeholders in Reform of the Global System for Mutual Legal Assistance

This essay contributes to the Privacy Project’s volume on Systematic Government Access to Private Sector Data, and also is part of our broader research and law reform project on Mutual Legal Assistance Treaties (MLATs) and law enforcement access to electronic evidence held in other nations. Specifically, this essay briefly explains the reasons why MLATs are vital and becoming increasingly important for law enforcement in this age of globalized evidence. It then adds to the previous literature by presenting the goals of key stakeholders in MLAT reform: the U.S. government, both for law enforcement and other goals; other national governments; technology companies, such as email and social network providers; and civil society, seeking goals including privacy, free speech, and democracy.Part A of the Article explains why two phenomenon are driving the increasing importance of MLATs: (1) storage of consumer records across borders due to Internet uses such as email and social networks; and (2) increasing use of encryption, blocking wiretaps in the user’s country.Part B examines the position of non-U.S. governments, and explains how advances in technology and the use of U.S.-based internet services has increasingly required these governments to petition the U.S. for access to electronic evidence. Part C explains the U.S. government’s position as a combination of law enforcement goals and other government sector goals. These goals include the need for positive working relationships with foreign governments, enabling legitimate law enforcement investigations, and protecting against attempts to use the MLAT system to violate human rights. Part D explains the goals of technology companies, including the wish to comply with lawful data requests, protect the human rights of their users, and find solutions that would persuade foreign governments to refrain from enacting burdensome localization or other regulatory measures. Lastly, Part E explains the goals of various U.S. and international civil society groups.They goals include a desire to raise U.S. and international standards for law enforcement investigations, maintain an open Internet, avoid data localization laws, and prevent a greater role for the International Telecommunications Union or other institutions that would splinter the global Internet. Other parts of our ongoing research will delve into the complex procedures and obstacles that characterize international mutual legal assistance today, as well as our proposed law reforms.Any such reforms, however, will have to be built on an accurate understanding of the incentives and perspectives of the major stakeholders. This essay focuses on that task.

Franklin E. Zimring and David S. Tanenhaus (eds.): Choosing the Future for American Juvenile Justice, New York University Press, New York, 2014, 256 pp, ISBN: 9781479816873

The current state of the American juvenile system is failing both the juveniles and the rights related to their welfare and the welfare of others. Due to this, it is imperative for new policies to be incorporated into the system to achieve progressive reforms in juvenile justice. Franklin E. Zimring and David S. Tanenhaus’ Choosing the Future for American Juvenile Justice provides the resources and arguments for doing so, as their book seeks to aid the development of more effective directions of future policies and institutions relating to the juvenile court’s delinquency jurisdiction. The book is divided into three parts. The first section profiles the attitudes and legislative changes that were results of the 1990s and how they are a part of current reform discussions. The second section identifies six important priorities for law reform that should be acted upon in the immediate future. Lastly, the third section searches for strategies and appeals for the juvenile system with the intent of achieving progressive reforms. By focusing in-depth analysis on multiple factors from numerous angles, the book reveals that that the current system in place is not accomplishing its goal and must be reformed in a more practical manner. The first two chapters, written by Zimring, focus on America’s youth violence because it was a main factor for the movement of state penal legislation in the 1990s and the priority of citizens’ concerns. His points are important because the violence done by juveniles and tests the extent of the severity with which the legal system can respond. The importance for reform is necessary because extreme youth violence is usually the initial spark of could become potentially criminal careers. Juveniles are in a vulnerable stage of their development and youth violence is a clear indication that the ones who should be protecting their well-being, the state and parents, are failing both individual adolescents and society as a whole. The book includes examples of the influx of school shootings in the 1990s, such as Columbine in the United States, that generated public fear and provoked new laws. Zimring’s argument depicts how public concern and prosecutorial ambition rooting from the 1990s produced legislation that reduced judicial and probation authority and shifted towards more prosecutorial power. The chapter convincingly reveals that this legislation should be reversed, and power should be reinstated with the judicial and probation authority. He demonstrates well that juveniles do not have the capacity to fully understand the consequences of their actions and should not be prosecuted to the same extent of adult criminals. Michael F. Caldwell goes in-depth as he covers the changes in law regulating juvenile sex offenders. He argues that scientific evidence concludes that the current policies should not be the same for juvenile sex offenders. After reviewing his evidence, the laws that require and extension of sex offender registration to adolescent sex offenders seem quite pointless. Because it is dealing with juveniles who are still in their vulnerable development stage, the requirement for registration provides no additional protection to the community or any assistance to law enforcement investigations. The only time juvenile sex offenders should be required to register as a sex offender is when they violate adult sex crimes, otherwise their actions should be addressed in a more sensitive and individualized manner. Aaron Kupchik, in Chapter 4, discusses how the increase in power and presence of police in schools is & Eric Kleiser ekleiser@indiana.edu

Recognizing and responding to cases of suspected animal cruelty, abuse, and neglect: what the veterinarian needs to know.

The identification of a “battered pets” syndrome, which put the veterinary profession on a parallel footing with its counterparts in human medicine who respond to battered children, women, and elders, expanded the veterinarian’s role as an advocate for animals’ welfare to include the recognition of, response to, and prevention of animal abuse. Professional policies and legislation in several nations have been amended to define these responsibilities and delineate appropriate responses when animal maltreatment or other forms of family violence are suspected. This article reviews these changes, discusses abuse as a matter of animal welfare and public health, and summarizes research describing animal abuse as a possible indicator and predictor of interpersonal violence. Five steps that helped build human health care’s response to child abuse, domestic violence, and elder abuse, and that are analogous to forces in contemporary veterinary practice, are described. It familiarizes practitioners with terminology used in animal cruelty investigations. It describes clinical presentations, client profiles and behaviors, and environmental conditions that may raise a practitioner’s index of suspicion of possible animal maltreatment. It reviews protocols that practitioners may employ to respond compassionately and effectively to suspected animal abuse and enhance successful law enforcement investigations and prosecutions. Such responses can unite human and veterinary medicine in a common concern for vulnerable, victimized, and at-risk populations and position veterinarians as an essential part of public health approaches to break the cycles of violence affecting animals and human members of the family and community.

Wrongful Convictions and Upstream Reform in the Criminal Justice System

The DNA exonerations of the late twentieth century spawned a reform movement arguably as influential in the American criminal justice system as the Warren Court criminal procedure revolution. The goal of innocence reform is to prevent wrongful convictions by increasing the reliability of criminal justice system operations. A basic tenet of the adversary system of justice is that an adversary trial will expose and correct factual errors with procedural tools, such as the exclusion of unreliable evidence, vigorous cross-examination of witnesses, and the introduction of expert testimony. However, DNA exonerations have undermined faith in the capacity of the adversary trial system to produce reliable results—shifting the focus “upstream” in the criminal justice system to earlier stages of law enforcement investigations. Upstream reforms target law enforcement investigative practices for improvements that will reduce or eliminate the production of unreliable evidence that will later need to be excluded, attacked, or explained at trial.

Productive and counterproductive interviewing techniques: Do law enforcement investigators know the difference?

To date, there has been very little research examining the knowledge and perceived use of productive and counterproductive investigative interviewing techniques by U.S. law enforcement. The current study attempted to address this gap in the literature by presenting 212 U.S. law enforcement interviewers with video vignettes depicting productive and counterproductive interviewing techniques via an online survey. Interviewers were asked to identify each technique, report their use of each technique, and give their reasons for use and nonuse, respectively. In a subsequent section of the survey, participants were given the names and descriptions of the techniques previously shown in the videos and asked to rate the efficacy of each technique. Investigative interview training experience and knowledge of the National Institute of Justice guidelines for eyewitness evidence were also assessed. Results revealed that real-world interviewers report using productive techniques more frequently than counterproductive techniques and that the primary reason for using any interviewing technique is its perceived efficacy in gathering accurate and plentiful information. Participants also rated productive techniques as being more effective at gathering accurate and plentiful information compared to counterproductive techniques. Of participants who reported receiving academy training after the National Institute of Justice guidelines were released, only 14.6% indicated that their interview training was based on those guidelines. Taken together, law enforcement investigators presented a general awareness that using productive witness interviewing techniques elicits more plentiful, accurate information from witnesses.

RELIGIOUS SCHOLARS: THEORY AND PRACTICE ACTIVITIES

The aim of the study is to consider the theoretical and practical problems of texts analysis of an extremist orientation; to define lacks of vocational training of religious scholars. Methods. The methods involve analysis of existing points of view on the issue; analysis of the conceptual apparatus; reflection of empirical experience of the expert participation in law enforcement investigation and at court. The present investigation is carried out based on the authors’ experience of expert activity. Results. The scientific inconsistency of widespread concepts "sect", «totalitarian sect», and «a destructive cult» is proved. Authors note that the term "sect" is necessary to use as religious concept exclusively in the sphere of studying of Christianity history. The necessity of correction of normative base is proved upon which many procedural and substantial questions of judicial religious examinations are solved. Scientific novelty. Specificity of religious expertise as a form of scientific research is presented; factors that negatively affect its results are identified; it is justified that the legal position and status of non-state independent religious experts actually are not determined, therefore, not protected. Practical significance. The use of theoretical research results allows activating theoretical component of educational activity on training personnel for Religious as in the system of higher education, and in self-education; it contributes to the development of tools of empirical research in the field of religious expertise and improves the quality of expert opinions.

Bioattribution Needs a Coherent International Approach to Improve Global Biosecurity.

The forensic investigation of hoax, suspected or actual biological weapons attacks, and bioproliferation activities is recognized by biosecurity-advanced nations as an important pillar in a national biosecurity program. Some nations have taken this seriously; most others have not or are not aware of the potential. When law enforcement and forensic science investigations are performed in a coordinated manner, decisions assigning attribution are informed and accountability is supported through legal and policy decisions and actions. Incorporating public health investigative and tailored scientific assets makes the system even more effective, dynamic, and robust. Perpetrators and enablers must be held at risk of being brought to justice, or through a policy decision resulting in direct action being taken or sanctions imposed. This paper provides a foundation and path forward to establish substantially expanded capability founded on establishing and leveraging national and regional programs and international agreement that attribution is an important component of biosecurity. Specific forward-looking initiatives will be recommended and discussed.

Fair play? Not so much: Corruption in the Italian football

Not only football is one of the world's most popular sports, but it is also a multi-billion euro global business. Due to its large turnover, football may offer the stage for the commission of a wide variety of misconducts and corrupt activities. Progressively over the last decade, Italian football has severely suffered from a number of corruptive malpractices, in some cases also perpetrated with the aid of organised crime groups. A number of scandals have been put under the spotlight of public opinion, such as the ones of Calciopoli (“City of Football”) and of Calcio scommesse (“Football Bets”). In all, the search for profit seemed to have pushed the game into the background, and from the law enforcement investigations a widespread culture of illegality has emerged. Despite attracting a great deal of media attention and public demise, corrupt practices perpetrated within or through football organisations have seldom been analysed by scholars against the backdrop of relevant criminological perspectives. By drawing on documentary sources (judicial files and media news), this paper shall (1) categorise and describe different modalities and patterns of corrupt deals in the Italian football; (2) examine the findings through relevant criminological theories; and (3) identify systemic opportunities for corruption.

Control systems/SCADA forensics, what's the difference?

Immature IT security, increasing network connectivity and unwavering media attention is causing an increase in the number of control system cyber security incidents. For forensic examinations in these environments, knowledge and skills are needed in the field of hardware, networks and data analysis. For forensic examiners, this paper is meant to be a crash course on control systems and their forensic opportunities, focussing on the differences compared to regular IT systems. Assistance from experienced field engineers during forensic acquisition of control systems seems inevitable in order to guarantee process safety, business continuity and examination efficiency. For people working in the control system community, this paper may be helpful to get an idea about specific forensic issues about which they would normally not bother, but may be crucial as soon as their systems are under attack or become part of a law enforcement investigation. For analysis of acquired data, existing tools for network security monitoring have useful functionality for forensic applications but are designed for real-time acquisition and often not directly usable for post-mortem analysis of acquired data in a forensically sound way. The constant and predictable way in which control systems normally behave makes forensic application of anomaly-based threat detection an interesting topic for further research.