Contextualising the investigation work in China: the facilitators and barriers in using mobile phone evidence

ABSTRACT

Despite the huge quantity of potentially relevant data on crimes, victims, and offenders generated by and associated with technologies such as smartphones, evidence suggests these are rarely used in court proceedings. Moreover, while empirical findings suggest that techniques for analysing digital trace evidence have outstripped the abilities of investigators to interpret it, there is a lack of research on the specific challenges and potential solutions for upskilling police officers to handle digital evidence. This study seeks to identify facilitators and barriers for investigators interpreting mobile phone evidence generated during criminal investigations in China. Based on interviews with 29 frontline investigators regarding their working experience and perceptions, findings illustrate that although Chinese legislation grants investigators access to and legitimacy in retaining mobile phone data and applying it as admissible evidence, and despite the acknowledged importance of this data, investigators often lack the capability to interpret it. The lack of functional techniques for efficiently reviewing and analysing data is identified as a barrier. But more importantly, unfamiliarity with technological innovations in criminal activities hinders investigators’ capabilities to understand the generation and meaning of mobile phone data within the context of the investigation.

KEYWORDS:

• Mobile phone evidence
• evidence interpretation
• policing cyber-related crime

Introduction

The advent and ubiquitous nature of the internet have provided a new avenue for criminal activities, with greater opportunities for committing existent (e.g. fraud and identity theft) and novel (phishing, money laundering) forms of offending (Clarke 2004, Goldsmith and Brewer 2015). The increasing involvement of internet-enabled devices, content, and material in criminal activities has created challenges in managing digital crime scenes and applying digital evidence in criminal procedures (Harkin et al. 2018, Wilson et al. 2022). Meanwhile, it has been acknowledged that responses to digital crime scenes and uses of digital evidence in the early stage of the investigation impact subsequent criminal procedures and court proceedings (Mason and Stanfield 2017). Mobile phone data, the focus of this study, is central to the challenges of managing digital traces and digital crime scenes, regardless of the specific crime type, because data associated with mobile phones is highly likely to reveal personal information and criminal activities. Compacted with large quantities of personal data that could be associated with offences or offenders, mobile phone data can be used as intelligence in answering crucial investigation questions. The increasing involvement of mobile phones in criminal activities has generated growing demands for the analysis of mobile forensic evidence (Quick and Choo 2017). Yet, although mobile phone data serves as an information source, there seems to be a gap between the potential usefulness of these data and the number of cases that have employed it as evidence in court (Quick and Choo 2017, Zhang et al. 2022).

In China, the site of the current study, the growth of the ‘mobile networked population’ has introduced significant cyber security challenges. The different chat protocols and social networks prevalent in China not only serve as criminal tools but also create a platform for the spread of disinformation (Zhuge et al. 2015). Since 2012, when digital evidence was listed in the Criminal Procedural Law (CPL) as an evidence type, the use of digital forensic evidence and its forensic process has been gradually standardised in procedural laws (Li and Guo 2019). Meanwhile, a series of network management policies and infrastructure projects regarding cybersecurity were launched by the Ministry of Public Security from 2000 onwards, and a huge quantity of databases containing identity information have been constructed (Walton 2001, Stockmann et al. 2020). The Chinese context would thus seem highly favourable to the collection and use of data linked to mobile phones in criminal investigations.

This empirical study reports mobile phone data (evidence) uses and the frontline investigation practices in China. This paper identifies that institutional awareness and support in personnel greatly enlarged the accessibility for grassroots investigators collecting and analysing mobile phone evidence. While the approachable methods and resources facilitated the application of mobile phone evidence, the key challenge concerns interpreting multiple sources of mobile phone data and establishing connections between criminals and their activities with digital traces.

Mobile phone data and digital forensics

Although processing mobile phone data, or more generally digital traces, is not limited to the investigation of cybercrime, research on the policing of cybercrime overlaps with the challenges and solutions regarding applying digital forensic evidence garnered from mobile phones. The increasing complexity and prevalence of criminal activities facilitated by internet tools challenge frontline officers’ knowledge of handling digital evidence. Police officers, as the first responders, should be equipped with the procedural knowledge to receive and report an offence, and basic investigation skills to preserve digital devices (Cross 2020, Wilson et al. 2022). Furthermore, employing digital traces as admissible evidence requires police investigators to update their knowledge about legislation (Karie and Venter 2015, De Paoli et al. 2021). However, there could be a temptation for police investigators to apply their past expertise in handling general cases to managing digital crime scenes and handling a large number of digital traces (De Paoli et al. 2021).

While capabilities for processing digital traces have been valued, providing sufficient and effective training to frontline officers has also been identified as a barrier to the effective handling of cases involving digital traces (De Paoli et al. 2021, Wilson et al. 2022). Recent research in Australia identified that less than 20% of police participants had participated in training regarding digital forensics (Wilson et al. 2022). Research by both Harkin and Whelan (2022) and De Paoli et al. (2021) underlined the necessity to provide a general level of knowledge to those investigating and responding to complainants’ crime reports, as they identified only a limited number of police departments provide this training.

With the growing demand for digital forensic analysis, the need for greater resourcing and personnel support in handling digital forensic analysis has been underlined (Harkin et al. 2018, De Paoli et al. 2021, Wilson-Kovacs and Wilcox 2023). In addition to filling the gap in personnel support, understanding the collaborative pattern between investigative departments and digital forensic analysts is necessary to resolve the escalating demands in handling digital crime scenes (Wilson-Kovacs and Wilcox 2023). Yet it remains unknown how frontline officers approach in-house or external personnel support, and to what extent this support can assist their investigations.

While mobile phone data can be highly informative for the investigation, limited empirical findings reveal how investigators exploit this information. Scholars in both investigation (Innes 2003) and forensic science (Ask and Alison 2010) have argued that the investigation, in essence, is information work, by which traces are identified, interpreted, ordered, and produced as case narratives for decision-making at trials. In this process, investigators’ knowledge and experience influence how information from different sources is evaluated and used as admissible evidence (Brown et al. 2023). In terms of mobile phone data, it remains unknown how this data can be exploited as intelligence or evidence in the investigation and whether investigators have sufficient knowledge to holistically analyse this data.

It is also necessary to understand police officers’ perceptions of investigation with mobile phone data and the support required by front-line investigators to handle digital evidence. The support in equipment, training, collaboration with external experts, and the existence of clear policy and guidance can add to officers’ confidence and influence their investigation practices (Bossler et al. 2020, Wilson et al. 2022). Therefore, understanding the facilitators and barriers in handling increasing digital traces grounded in police officers’ experience and perceptions is necessary for shedding light on future policies specific to processing digital traces (Holt and Bossler 2014). However, there has been limited research on current levels of preparedness and the resources that have been utilised by frontline officers (Bossler et al. 2020).

The Chinese context

In addition to the legal frameworks noted above, China has a different type of internet culture to many other countries, owing to blocks on accessing some websites (Liang and Lu 2010, Hobbs and Roberts 2018). For example, The Great Firewall project was launched to block some foreign websites and social networking applications including Facebook, X/Twitter, Instagram, and Google, from mainland China IP addresses (Stockmann et al. 2020). Within this block policy, domestic mobile applications, like WeChat and QQ function in some ways similar to WhatsApp, and have become mainstream applications covering uses ranging from the usual entertainment feeds to social infrastructure. These data can be used for investigating the communication between two parties (Liang and Lu 2010).

Another critical cyber security infrastructure project is the Golden Shield Project, which was launched by the Ministry of Public Security (MPS) in 2000. This project targets information construction and has within its databases a huge amount of information on citizens (Walton 2001), including identity information, records of close-circuit television, registered phone numbers, registered vehicle information, and individuals’ transportation information (flight and trains), etc. More than a nationwide security network, this project also provides a data-sharing channel among police departments at different levels, regions, and specialisations, with the expressed aim of improving responsiveness and capacity in combating crime (Walton 2001, Tsui 2003). Furthermore, the real-name registration¹ policy provides the possibility of making easy inferences from digital accounts to real individuals, since the policy largely eradicates anonymous users in mainstream social media and online payment tools (Lee and Liu 2015).

The unique mobile network features and administration of the internet in China would all seem to set up an environment extremely amenable to the digital investigation of crime. However, while databases are available for investigations, the added value of this information remains questioned (Brodeur 2010, Brown et al. 2014). With the volume of matched data identified in databases, multiple lines of data could be unmanageable and result in the inefficiency in generating intelligence for the investigation (Ribaux et al. 2017). Besides, the interpretation of this information provided by databases could be poorly situated in specific investigation contexts (Ribaux et al. 2017, Earwaker et al. 2020), which may barrier the generation of admissible evidence in the legal process. Given the context of China, databases-driven evolution also exists in policing, but it remains unknown how the advantages of data or evidence collection can benefit front-line investigation.

Considering the great difference in these areas between China and many other countries, investigation practices in China have been strikingly under-researched. Questions of how police in China think about conducting investigations in this environment. More importantly, it is necessary to understand how police adapted to this novel situation into their existing knowledge framework.

To set the scene of the investigation work in China and fill the aforementioned research gap, this current study reports findings of a qualitative analysis of police officers’ understandings of the cases they routinely handle and the mobile phone data (evidence) used in the investigation. The scope of policing cyber-related crimes is narrowed to the uses of mobile phone evidence/intelligence: by concentrating on facilitators and barriers that existed in the current investigation working context, understanding of the uses of digital evidence in investigation work can be better de-limited and contextualised (Earwaker et al. 2020). Thus, the research questions guiding this study are as follows:

1. How do police officers experience conducting investigations using mobile phone evidence?

2. What facilitators and barriers are perceived by police officers when they use mobile phone evidence?

Methods

Decision-making during criminal investigations integrates with a consideration of diverse information sources, different forms of knowledge, and interlaced forms of reasoning (Morgan 2017). To include and explore the diverse circumstances in the criminal investigation and uses of evidence, this research employed semi-structured interviews to understand investigators’ perceptions and capture the characteristics of their practices (Lune and Berg 2017).

The author conducted six-month field research, from April to September 2021. Diverse social contexts across different regions in China cities or towns from Tier 1 to Tier 4 were included. This ranking of cities in China is a common classification describing the development of cities (China Business Network 2019). To provide sufficient context information and avoid participants being individualised, Table A1 in the Appendix provides basic anonymised demographic information related to eligibility criteria. This study analysed interviews with police officers to contextualise the front-line investigation work and practices that involve mobile phone evidence. This research sought to understand the process of adapting investigations in cyberspace and explore the specific support that investigators feel is needed in the investigation.

Participants and sampling

During the field research, 29 police officers were recruited by snowball sampling. This research recruited police officers who had more than two years of experience in investigation or handling evidence, considering the entrance training time of police officers in China. Through referrals, participants with experience in processing mobile phone evidence and cooperating with investigators were identified and recruited, including investigators, digital forensic officers, and legal affairs officers.

Conducting fieldwork in China and targeting officers in criminal justice systems made it difficult for the researcher, an academic outsider who is affiliated with a foreign institution, to approach potential participants (Peerenboom 2001, Liang and Wilson 2008). To approach police officers, it is important to build and rely on interpersonal relationships between interviewer and participants or referrals (Liang and Lu 2006). Besides, to recruit participants with certain experience, the researcher tried to understand potential participants’ work in advance. Therefore, snowball sampling was applied as an optimal solution for this research to locate and contact investigators (Boeri and Lamonica 2015, Lune and Berg 2017).

Interviewee A1, who is acquainted with the researcher, was approached as the initial contact. Through snowballing, this interviewee introduced five participants from his agency or different agencies in the same city. To overcome the barriers of going beyond the network of this interviewee (Boeri and Lamonica 2015), the researcher attempted to approach police officers from other provinces who were acquainted with the research. They played the role of ‘brokers’ to refer the researcher to police officers with relevant attributes, like experience in investigating, analysing mobile phone evidence, or leading investigation departments, etc., to participate in the interview (see Table A1). While the ‘brokers’ built the interpersonal connection, they also played the role of ‘gatekeepers’ who allowed the researcher to approach participants and demonstrate the credentials and trustworthiness of the researcher.

At the point of securing informed consent, requiring a signature can jeopardise the anonymity of participants, as well as their willingness to take part in a study (Liang and Lu 2006). Therefore, this research waived a signed consent form; instead, oral consent was reached at the beginning of each interview. Before asking participants to come to the interview, a topic guide with a research introduction and a consent form was sent to middlemen and transferred to participants via WeChat, a commonly used instant messaging tool in China. This step sought to ensure that the content of the interview would not conflict with any regulations or cause participants any trouble. If participants had no questions about the consent form and approved audio-recording, a verbal explanation of measures taken to protect anonymity and uses of their data was delivered again, at the beginning stage of each interview. At the time of the field research, there were no explicit ethical guidelines in China for social researchers in these kinds of situations. The potential repercussions of revealing confidential information or unresolved cases in this study were not much of a risk, as participants were very cautious in their approach to the interviews. This study went through university ethics committee consideration and got the approval to collect and use data anonymously for this study.

As the interview data accumulated, data saturation emerged and revealed certain patterns and experience, which indicated that the sampling process could end (Morse 1995, Flick 2009). Eventually, 29 police officers from five provinces were included. To analyse data anonymously, the transcribed data were coded with initials corresponding to the agency location where participants were working (e.g. from A[n] to L[n]).

Organisational context of this field research

Police participants came from different administrative levels of police departments, ranging from grassroots police stations, county bureaus, municipal bureaus, and provincial departments. Following the hierarchical structure of government, the national policing bureau (MPS) takes a leading and commanding role who guides and supports departments under their leadership but does not directly take charge of investigating any specific case. The MPS is the highest authority, followed by the provincial department (in each province, autonomous region, or municipality), municipal police bureau, district (or county) sub-bureaus, and their subordinate police stations. Police stations, as dispersed offices of a district sub-bureau, are the grassroots level of the police structure (Chen 2016).

Expect the MPS, all other administrative levels of policing departments conduct the investigation on specific cases. Depending on the seriousness, the geographical distribution of an offence (or series of crimes), and the type of crimes, cases would be assigned to investigation units with corresponding specialties under different levels of policing bureaus. Collaboration among departments in different administrations and regions was relatively common.

At each level of the police organisation, there are offices for different categories of investigation, legal offices, and sometimes forensic offices. Departments in this research covered criminal, financial, and cybercrime investigations. It should be noted that cyber-related crime, a frequently mentioned crime type through interviews, was not the task exclusively for cybercrime departments. For instance, the criminal investigation office can be assigned an online gambling case; the financial investigation unit could handle an internet financial fraud; and cybercrime units may take assisting roles in handling criminal or financial cases. Besides, in some regions included in this research, cybercrime units also take charge of analysing digital forensic evidence and conducting crime scene investigations when digital devices are involved. Under this working context, participants from multiple administrative levels could provide investigation experience covering diverse types of offences. Participants’ experience shared in interviews was not exclusively concentrated on specific types of investigation but focused on the uses of mobile phone data (evidence) and more generally, digital traces.

Interviews

Apart from five telephone interviews, all interviews were accomplished in person. Each started with an informal chat in order to get familiar with the individual interviewee’s experience and adjust the specific questions. With snowball sampling, referrers would assume that the research aimed to conclude a ‘positive’ result, like mobile phone evidence is useful, and pass this information on, which might risk participants providing ‘expected’ responses and inflate their perceived function of mobile phone data in the investigation (Boeri and Lamonica 2015). Starting the interview with questions about the investigators’ general experience could minimise the influence of widespread knowledge of the eligibility criteria.

Depending on the schedule of each participant, some interviews were held in the office of the participant or at a private table in a restaurant. All interviews were recorded. The interview lasted from 40 minutes to 3 hours, with the time-varying depending on participants’ experience and the progress of each interview. Although a topic guide for the semi-structured interviews was presented and guided the themes to be covered, interviews did not follow a rigid pattern. Instead, questions were dropped if they were deemed irrelevant based on the experience and role of the officers; or in some instances, additional follow-up questions were asked to probe further into an area of interest. This was done to maintain the conversational style and to build rapport with the interviewee. Moreover, the interview design relied as much as possible on the experience and perception of participants, so that the complex situations and various meanings in the specific context mentioned by interviewees could be analysed (Lincoln and Guba 1985, Creswell 2009).

Analysis

To contextualise the investigation practices and identify factors featured in investigation work, this research employed a framework approach for thematic analysis, an analytical method to answer contextual and diagnostic questions for policy research (Ritchie and Spencer 2002). The transcripts were input and processed in NVivo 12. The analysis generally followed the five stages: (1) Familiarising: reading through each interview and summarising segments of data as descriptive codes; (2) Framing: reviewing the materials and identifying a thematic framework; (3) Indexing: applying the thematic framework to code data in the transcripts; (4) Charting: adjusting thematic framework and codes based on thematic references; (5) Interpreting: comparing the difference and similarity. While the objective of this research is to investigate the actual practice of criminal investigation, the analysis was based on the ‘reality’ experienced, perceived, and reported by interviewees. In the interviews, however, participants were encouraged to provide concrete examples to support their perceptions.

Findings

First, findings illustrate that, saturated with cyber elements, the investigation working context highly valued digital forensics, and collecting mobile phone data became routine work. Second, this research identifies the key facilitators enabling front-line investigators to detain and fix this data as evidence in multiple ways. While these facilitators enlarged the available information sources, the high volume and complexity of mobile phone data created challenges for analysing these data. The challenge of processing mobile phone data could be intensified when investigators established the linkage with the origins of digital traces, due to investigators’ unfamiliarity with the application of technology innovations in criminal activities. The following section explains the generation of institutional awareness of mobile phone evidence and how this awareness influenced the investigation practices.

The increasing demands and usages of mobile phone data

The institutional awareness of mobile phone evidence

Police participants noted that cyber elements were increasingly common to many crime types, and handling criminal activities in cyber contexts had already become a focus of their work. Mobile phones or other digital devices were frequently employed for criminal purposes and generated digital traces in cyberspace. The digital crime scene was usually regarded as an extension of the physical crime scene. Here, a participant describes this change in crime scene investigation:

[…] About 60% of cases are telecom and online frauds. There are fewer physical crime scenes for you to conduct an on-site investigation. […] Now and future, crimes will be intensively congregated in mobile networks; traces will be packed up in mobile applications. Then mobile phone is our crime scene where the investigation should be conducted. This [virtual crime] scene would be no different from other crime scenes, like the one of murder cases. (Interviewee A3)

Investigators considered that, as mobile phones get increasingly involved in criminal activities, a virtual crime scene where an offence could be conducted or prepared would be as important as a physical one. Consequently, investigating and collecting mobile phone evidence was regarded as a necessary skill not only for investigating cyber-related crime but also for other types of crime investigation. Views from participants from different departments and regions converged on this point.

The awareness of digital evidence was underlined in a top-down way. In one agency, the principle of collecting digital evidence was diffused as an eight-character slogan in Chinese reminding officers not to overlook any device or data that may contain key evidence ‘应采尽采，应查尽查’, which can be translated as the following quote:

When it [digital devices] should be collected, then [we should try our best to] collect all related devices [on the crime scene]; When it [a digital device] should be examined, then [we should try our best to] examine all data included [in each device]. (Interviewee G1)

Under the police organisational structure in China, police bureaus at higher administrative levels not only handle cases within their territory, but also support the work of their subordinate bureaus. Directly getting involved in the investigation work that was saturated with cyber elements, higher-level bureaus valued the work of digital forensics, and this awareness was generalised to all investigations with digital devices. Meanwhile, handling digital evidence has gradually become an institutional priority.

Uses of mobile phone evidence in practice

The institutional awareness of mobile phone evidence value was generalised to other types of crime investigation, and obtaining data from suspects’ mobile phones became a routine step and a breakthrough in information collection. Participants underlined the priority of detaining mobile phone data: ‘The first thing needed to be done after controlling a suspect is detaining his [or her] mobile phone, including internet isolation and asking suspects for password’ (Interviewee G2). A cybercrime investigator cited his experience in collaboration with criminal investigators to explain this swift reaction, as the following quote.

But nowadays, no one can live without a mobile phone. Therefore, identifying a mobile phone is equal to identifying an individual, which probably is our ultimate logic. […] If we want to have some progress in criminal investigation, the availability of criminals’ phone number is critical, because this number can be used to track the perpetrator as soon as possible. (Interviewee A3)

Among data from multiple applications, participants identified WeChat and Alipay records as the data that they would not overlook when checking mobile phones in a crime scene, regardless of the specific case under investigation. Investigators expected to find communication and transactions in WeChat and Alipay that would help to identify the connections between offenders and victims.

[…] As a messaging tool, no matter the connection between victims and criminals, or criminals and accomplices, there would be some traces left. […] Their chatting records, pictures, snapshots, and transaction records in online payment apps are all my focuses. WeChat and Alipay are apps that I will definitely have a look. (Interviewee C1)

Other interviewees underlined that diverse types of mobile phone data were used integrally with all available information for multiple lines of inquiries, and its use was not dependent on the type of data. Besides, as mobile phone data can reveal individuals’ daily activities, the intelligence value was not restricted to the investigation of cyber-related crimes.

Three major ways of accessing and presenting mobile phone evidence were identified by participants: manual extraction (fixing evidence by printing, photographing, and video recording); physical extraction (capturing the memory of mobile phone via software or a modified boot loader which is sent through the connection between the device and forensics workstation); and collecting from service providers. While there were multiple ways of fixing mobile phone evidence, investigators evaluated the accessibility of technical resources and the convenience of approaching these resources to decide the exact way to fix a piece of evidence.

Accessibility of mobile phone data

The resources provided to investigators could be one factor that accounts for the disparities in approaches to collect mobile phone data and use it as evidence. The resources available to assist investigators in using mobile phone evidence included standardised digital forensic rules, the cooperation of private sector companies, personnel arrangements, and policing information systems. These supportive factors were necessary for demonstrating the authenticity and integrity of the retrieved mobile phone data and presenting mobile phone evidence in legitimate formats that can be recognised and accepted through criminal justice processes – above all, for presentation in the case file which was finished by police officers and eventually used in the court proceedings. Some interviewees did not make a distinction between using mobile phone evidence and using digital evidence in general, as both share supportive factors and challenges.

Accessibility enabled by legitimate approaches for forensic examination

Interviewees noted that to accomplish the digital forensic examination and use it as admissible evidence, one took the form of expert opinion, as it standardised in the CPL, a result provided by forensic science institutions. However, from the report of other local officers, they would not always have the advantage of approach forensic laboratories, considering the budgets, time, and efforts. An interviewee underlined that local departments more often use the transcript of the crime scene investigation or investigative re-enactment recording the examination process as an alternative format presenting digital forensic examination. This format which standardised by provisions² in addition to CPL added accessibility for frontline officers to consolidate digital evidence, as the following quote explains:

Since a judicial interpretation of the rule (which regulates the uses of digital evidence) issued by the Office of Cyber Security (in the Ministry of Public Security), the Supreme Court and Supreme Procuratorate, allows the same probative value for transcript and expert opinion in presenting digital evidence. […] This method enables us to consolidate digital evidence by officers from our departments, when forensic experts cannot be approached. In the past two decades, there have been many cases that used transcripts to present digital evidence. (Interviewee A3)

The standardised rules enabled grassroots officers to choose the most accessible way and achieve the admissibility and probative value of the digital evidence.

Accessibility enabled by private sectors

Collecting mobile phone data from service providers was reckoned as a common way to consolidate this evidence due to the standardised and simplified evidence collection procedures. The right to collect evidence from relevant entities is provided in CPL (Article 54). When a criminal case is involved, Article 54 will override the privacy contract between service providers and their users, which clarifies the duty of cooperating with criminal investigations. With permission to ask for cooperation issued by a police organisation, investigators explained that they could collect evidence from service providers in a legitimate way and ensure the authenticity of the data at the same time. In this case, digital evidence could be collected from banks, telephone companies or mobile application service providers, like Tencent (the company that owns WeChat) or Alibaba (the company that owns Alipay).

Although interviews revealed that investigators used to consider the time, budget and workload costs of collecting evidence from third parties in this way, this issue had been partially mitigated. Service providers, like Tencent and Alibaba, have standardised and simplified their internal approval process for providing data to investigation departments. As explained in many interviews, such routes for collecting evidence saved money, effort and time.

[…] If there is a necessity to ask for cooperation and obtain evidence from company that own data, like Tencent and Alibaba, there are departments especially responsible for communicating with us (police). We just need to follow their internal procedures for gaining access. Previously, business travel for collecting evidence was necessary in some cases, but now the procedures can be finished online, and authentic data can be collected. And we don’t need to worry about legal issues. (Interviewee A1)

With the active cooperation of IT giants who possessed data from mainstream mobile applications, information sources could be accessed conveniently. Meanwhile, the admissibility of this material as evidence could be guaranteed with the original data endorsed by the service providers.

Accessibility enabled by personnel arrangement

The common methods of accessing mobile phone data reported by participants varied across grass-roots police stations in different regions. Findings from interviews revealed that this disparity resulted from variations in support on personnel and devices. According to participants from Province 5, each grassroots police station was staffed with its own officers who were tasked with handling digital evidence and investigating cybercrime. A forensic workstation for mobile phone data extraction was equipped in each police station. These officers used to be criminal investigators without any background in cybercrime investigation. With the increasing amount of cyber-related cases and digital evidence, some districts/counties trained police officers in grassroots stations in the basic skills of managing crime scenes with digital devices and conducting digital forensic examinations. With this arrangement, the local police stations would not need to ask for help from their leading district/county bureau. A senior officer who led this personnel reformation provided a brief explanation of this personnel arrangement, ‘Cybercrime Agent Scheme’:

[…] But currently our cybercrime agent can only solve some basic and routine investigation work, like retrieving mobile phone evidence. […] Actually, there is a higher demand of cyber-investigation expert. For some of these agents, they helped a lot with investigating cyber-related crimes. […] Therefore, roughly 90% of cases in grassroot stations, officers with cybercrime knowledge are needed. But the thing is that we still lack experts in this filed, even for our municipal bureau. (Interviewee J1)

With the officers taking charge of basic forensic analysis in grassroots departments, correspondingly, investigators from Province 5 rarely mentioned the difficulties in accessing resources for digital forensic examinations. By contrast, in Provinces 1 and 2, officers from grass-roots stations commonly fixed mobile phone evidence by manually browsing and printing the key sections. When large amounts of data needed to be processed, rather than asking for help from colleagues in the same office, officers needed to seek help from the cybercrime branch of their superior bureaus.

Normally a screenshot of chatting or transaction records can be sufficient confirmation, which is quite accessible. […] Our department is not equipped with the device [for physical extraction]. We sometimes may ask them (the district bureau) for help. In the investigation of online gambling and other cyber-related cases, we would find tech-savvy staff in criminal division and let them save the data in a CD to use as evidence in the court files. (Interviewee A4)

Although the personnel and technical support in Province 5 resolved the demand for digital forensic examination in the local police department, in essence, digital forensic work was assigned to a certain group of officers. For larger groups of investigators, they would not need to upskill themselves.

Accessibility enabled by information system

With the real-name policy, policing information systems were identified by participants as resources enabling the production of intelligence with individual-specific information. The police information system is a computerised data storage and management platform for police officers to record and search case data. It links to multiple databases serving different purposes, ranging from vehicle registration information, SIM card registration records, databases for anti-fraud, biometric data for forensic intelligence, etc. Working in different positions, investigators would be granted access to different databases.

Participants explained that multiple databases facilitated linking identity information and mobile phone data. In this case, mobile phone data can be attributed to an individual and used for inferring their activities. In the following quote, the investigator explains how information systems can produce intelligence even if only the mobile phone number is available.

If we have a mobile phone number, many data can be reflected with it. With the request from [cyber unit officers to use information system], we can link this number with other data stored in the information system to know if this number was used to register any mobile application account; who normally contacts with this number, who is the actual user of this number; whether the user is the suspect. From my perspective, the mobile phone number is really useful, when you combine this number with so many databases. (Interviewee G2)

Barriers to using mobile phone data

Although institutional factors enabling the multiple ways of collecting and analysing mobile phone evidence, investigators’ capability of processing a great amount of mobile phone data from multiple sources barrier producing intelligence with this data and supporting the investigation or evidence presented in the court.

Processing massive data

To process raw mobile phone data into intelligence or evidence that may contribute to the outcome of an investigation, investigators needed to read massive records of communication or transactions. Participants noted the limited efficiency of their mobile phone data analysis work and indicated that lack of tools for reading massive data was one barrier to using mobile phone evidence. The following quote provides a more detailed description of this drawback of forensic tools.

Currently, we probably don’t have a device or software especially for reading data, although the software [for data extraction] that we always use is provided by [company name]. […] But it is not that convenient. The design of its pages for browsing data is poor. It seems that they build a structure [in the view page], but you cannot use it smoothly. […] What we expected is a software which can make browsing evidence just like swiping our own mobile phone. It can be even better, if it can highlight data should be focused on. (Interviewee K2)

The inefficiency in reading massive mobile phone data was not only attributed to lacking advanced software, but also functional office equipment, like computers, printers, CD-ROMs, which function as carriers of mobile phone data retrieved by various methods, as described by one participant:

In each case, nearly one-third of investigation time is spent on handling computer issues. […] There are seven officers and seven computers in my office, but only one functional computer. (Interviewee A5)

Comprehending data of different types

In two interviews (with Interviewees B2 and F1), the challenge of interpreting a great variety of mobile phone data was mentioned. They realised that it was difficult for elder officers to catch up with the fast development in mobile applications, which consequently created challenges for interpreting mobile phone data, as the following interviewee provided:

The huge quantity of data would be a challenge for me, and it takes a long time analysing mobile phone data. […] Apart from that, sometimes I may get confused about the basic function of some new applications. As I am an 80s generation (born around 1980), I may never use some applications. When I open the data in these applications, I have no idea about how to interpret their features, like accounts or something. (Interviewee F1)

Investigators’ illiteracy to different mobile data barriered them from comprehending the activities in new mobile applications. The huge quantity and diversity of mobile phone data therefore created challenges for investigators to interpret and generate intelligence from raw data.

Challenges of investigating in the cyber context

Regardless of the types of crime and the formats of traces, mobile phone data or other digital traces would be interpreted as an integral component of all available information in the investigation. Participants perceived that the reasoning way of comprehending an incident maintained the same, no matter cyber-elements were involved or not. However, the main challenge of processing mobile phone data lies in attributing these digital traces to their physically existing origins and identifying the real identity of criminals, due to the unfamiliarity with the evolving crime pattern facilitated by mobile applications and other technological innovations.

Challenges of interpreting an incident with cyber elements

While the prevalence of digital traces resulted in challenges in processing the volume of information, participants regarded this segment of data as an integral component within the comprehensive scope of all available information. In this case, the way to process mobile phone data or other digital traces maintained the same as to understand an incident. This similarity was described as ‘the logic of investigation’ (Interviewee H2) or ‘the mind of investigation’ (Interviewee L2). Before specialised knowledge for analysing mobile phone data, the way to interpret an incident was regarded as the basis of the investigation and the similarity which investigator could draw from past experience and apply it in investigating cases with digital traces. As explained in the following quote, the reasoning pattern of identifying key compositions of a crime based on its definition in law can also be applied in the investigation of cases with cyber-elements.

There definitely would be something different, as new technologies get commonly applied. […] But the logic of investigation is still the universal issue. […] The format of evidence that should be collected is different. However the way to conduct the investigation is the same as investigating traditional criminal crimes. We still follow the constituents of a crime defined by law. I still deem that this traditional reasoning way is necessary. (Interviewee H2)

Investigators identified the difference in terms of the ‘new information dimension’ comprised of digital traces generated by cyber-facilitated activities. As criminal conducts get increasingly facilitated by mobile devices or other technological innovations, the formats of traces and the way to consolidate them as evidence also changed. According to interviewee A2, this difference in evidence collection becomes salient when they need to attribute digital traces in cyber-space to their origins which physically existed. The following quotation illustrates:

But nowadays, lots of crime moved to cyberspaces. They used the internet as a tool, a platform or a space that creates a new cyber dimension of crime scenes. […] But you need to think about how to consolidate [facts] with evidence, especially illustrating its connectivity and authenticity. […] Either the internet is used as a tool or platform, there is an issue about the identification of evidence. For example, in gambling cases, I need to identify the real identity of this account owner. […] But to reconstruct past activities with these data, I also need to match the figures with the corresponding activities. (Interviewee A2)

As the investigation is an information work, the increasing digital imprints would be processed integrally with all available information, which was explained in terms of similarity between crimes with and without cyber-elements. But the decision of evidence collection and interpretation depended on investigators’ experience and knowledge and eventually influenced how segments of information would be assembled into a case narrative (Brown et al. 2023).

However, several interviews noticed that in part due to investigators’ unfamiliarity with newly emerging or evolving crime patterns facilitated by internet tools, it was difficult for them to establish connections between digital traces and corresponding origin criminal conducts. Rather than understanding ‘how’ to consolidate evidence with digital forensic techniques, the key challenge for investigating cyber-related crimes concerned figuring out ‘which’ traces were necessary for legal proceedings. The prerequisite to address this issue concerned the understanding of criminal activities that generated digital traces, which is explained by the following quote:

What we need to understand is the pattern of cybercrime and its trend, the latest criminal conduct. Because criminals have better capability in applying technologies than us. […] It poses little influence on retrieving evidence, as the forensic technique sooner or later can be developed. But it does make a difference for you to decide what evidence should be included and where to find it. (Interviewee A2)

To interpret digital traces and attribute them to the original enactors and corresponding behaviours, the knowledge of the application of technological innovations in criminal conduct is required for investigators. As both the volume and diversity of mobile phone data challenged investigators to interpret (See section ‘Barriers to use mobile phone data’), the unfamiliarity of the evolving criminal conducts facilitated by internet tools made it more difficult for investigators to distinguish the relevant mobile phone evidence from the volume of data and establish crime facts.

Obstacles in tracking criminals

Interviewees considered the real-name policy as a premise for connecting identity with data from mobile phone or information systems and confirming the registered real name of a mobile phone as their first task to be addressed, once the device was available. However, interviewees acknowledged that even with the mobile phone data and data from information systems, the added intelligence on criminals’ identity would be limited. Since prior to the stage when suspects could be identified, available mobile phone data for investigators were limited to the information provided by complainants. However, participants reported that it was rather difficult to establish a consistent identification of data provided by complainants, registered identity in policing information system and the actual enactor of an offence. As one interviewee indicated:

One difficulty is restoring criminal’s identity. […] There definitely will be someone reporting what happened and what he (criminal) sent. But it takes time for you to analyse who he is, where he is. […] And you may find plenty of data or accounts would not be traceable. In some cases, the account would be owned by someone who apparently not the criminal. (Interviewee A6)

Participants felt that one barrier to spotting criminals was their inability to use data from overseas mobile applications. Due to the prohibition of commercial VPNs, participants would not commonly use foreign applications in their daily lives. For criminals, they could be more motivated to access VPNs from illegal routes. But police officers could rarely approach it and use overseas applications routinely, at least they would not reveal themselves in the interview. Without familiarity with foreign mobile applications and flexible access to data in these applications, it was difficult for investigators to find criminals’ real identities or interpret any suspicious conduct. Interviewees also mentioned that foreign applications were frequently employed by criminals as anti-forensic conduct. The following quote explains the uses of international applications and the barrier to the investigation:

As in many domestic cybercrimes, there probably are many cases with foreign applications to circumvent censorship. In this way, we would not know the information in these applications, not to mention the registration information. […] It is impossible for us to get communication information and know the chatting contents and related individuals. […] In this sense, it is difficult to find his (the criminal’s) real identity. (Interviewee A2)

According to this interview, investigators doubted their capability to collect and understand data from foreign applications. Consequently, they could miss the identity information of criminals, because data in international applications were not accessed or correctly interpreted.

Discussion

This research primarily identifies the institutional awareness of mobile phone evidence. This top-down awareness can be attributed to the existing policing work in the context which was saturated with digital evidence. Frequently encountering cyber-elements, investigators were aware the value of mobile phone evidence in general types of criminal investigation, not limited to cyber-related crimes.

This study further analyse current practices of handling mobile phone evidence and resources supporting these practices. For frontline officers, manual extraction and physical extraction seem to be the two most common ways to fix mobile phone evidence. This finding echoes arguments in previously published papers (Holt and Bossler 2012, Ribaux et al. 2017, Harkin et al. 2018) which noted that forensic work of processing mobile phone data is no longer confined to forensic laboratories. However, demonstrating the connection between traces and interpreted behaviour and suspect was still challenging for investigators.

With the analysis of the experiential factors behind police perceptions, this section further discusses factors that would facilitate or hinder the investigation with digital traces.

Supportive factors for using mobile phone evidence

The legal context in China and personnel arrangement in local departments were identified as the supportive factors. Regardless of the specific regulations granting police power to access data/evidence, laws and institutional policies enabled multiple admissible approaches to consolidate mobile phone evidence, so that investigators can decide the appropriate way to fix mobile phone evidence based on specific circumstances and available resources. In addition to law and institutional policies about mobile phone evidence application, the high awareness from the command team and personnel arrangements provide effective and reachable resources for front-line investigators. Across the local police departments in Province 5, the shortage of forensic and cybercrime experts and devices was mitigated by providing personnel with basic knowledge to handle digital forensic examination and cyber-related crimes. Therefore, command teams played the role who understood the practical needs of front-line investigation and formulated corresponding policies, while raising high awareness regarding cyber-related crime and digital forensic work (Levi 2017, Harkin et al. 2018).

Techniques for evidence interpretation

While with high awareness of digital forensics from the command team, the findings of this study indicate that lack of adequate tools barriered front-line officers from browsing and analysing the volume of mobile phone data. Currently, manually browsing data and printing screenshots is a common practice for fixing mobile phone evidence. However, with the increasing volumes of digital traces involved in a case, police participants noted that the efficiency of analysing these data was hindered by the unfriendly design of browsers and lagging computers to load a digital forensic report in their office, which echoes with the major challenge identified by previous research (Quick and Choo 2017, De Paoli et al. 2021, Hadlington et al. 2021). For police departments, providing functional computers and office facilities would be the basic premise for applying mobile phone evidence scientifically in the investigation.

Going beyond the current demands for manually browsing huge amounts of mobile phone data, it is worthwhile for developers of digital forensic tools to improve the visualisation of the digital forensic tools and provide solutions for processing volume of data under specific investigation contexts.

Knowledge of the internet and criminal activities

The findings of this study further implicate that investigators regarded imprints from digital crime scenes as a new dimension of information that is integral to the investigation. Rather than processing this information in a unique or distinct way, investigators realised the similarity between investigating digital and physical crime scenes and analysed digital imprints with the similar ‘logic of the investigation’ for processing information from physical scenes.

Being reflective of the essence of investigation, an information work (Innes 2003, Ask and Alison 2010), the way investigators understand an event and process information remains unchanged. In the process of adapting the investigation in the cyber context, the investigation logic can facilitate investigators to adopt past experience and apply it in processing digital imprints (Hadlington et al. 2021), and anchor investigators’ preparedness and capabilities to handle the evolving and changing crime activities in the future (Bossler et al. 2020).

Despite the similarity, participants underlined the difference of investigating crime with cyber elements – the challenge of attributing digital traces to the physical person who enacted the activities. Lacking knowledge about new crime patterns and how these crimes are facilitated by mobile applications and other internet tools hindered investigators from interpreting evidence, and establishing facts. Similar issues with the knowledge of crime patterns were also underlined in qualitative research into policing cybercrime (Harkin et al. 2018, De Paoli et al. 2021). Yet, this knowledge gap could be hardly addressed, due to limited opportunities of being exposed to offences facilitated by diverse technological innovations (Gannon and Doig 2010). The findings of this current study illustrate that participants rarely set themselves out of responsibilities of investigating activities that occurred in cyberspace. Admittedly, this apparent readiness to engage in new techniques and so forth could be partly due to the positive image that participants tended to present in the interviews. However, local investigators perceived that their position limited the scope of cases they normally handled, as a result, readiness for crime patterns could hardly be improved through their daily work.

While specialised knowledge is demanded, through the interviews, this study just noticed the training of digital forensic examination which provided to certain group of local officers, as a part of the ‘Cybercrime Agent Scheme’. Besides, although investigator participants realised the knowledge gap in interpreting mobile phone data and other digital imprints, they did not describe training as a necessary support for them to bridge the knowledge gap.

However, given the evolving criminal conduct and increasing volume of digital traces, relying on manual analysis and past experience would not be valid. Complying with the studies by Cross (2020), Wilson et al. (2022), and Brown et al. (2023), the findings of this study indicate that, when a volume of digital evidence can be available, general training for investigators to manage information from diverse sources and comprehend an incident would be necessary to enable investigators to establish facts with available digital evidence. However, this study is limited to further indicating the content and ways of training. It is worthwhile for future research on mobile phone evidence to look into the decision-making process of evaluating evidence (Fahsing and Ask 2016, Morgan 2017), and the knowledge and experience acquisition process (Earwaker et al. 2020).

Conclusion

In China, the investigation working context statured with digital imprints, especially mobile phone data which were prevalently involved in the investigation. Under this context, investigators and their agencies were very aware of the value of mobile phone evidence, regardless of the type of crime. The legislation on evidence access, and management of the physical networks set an amenable environment that minimised problems with data acquisition or retention. Yet, the key challenge highlighted in this study concerns the capability to interpret mobile phone data and consolidate it as admissible evidence illustrating criminals’ conduct. Investigators regarded the reasoning logic as an anchor to apply their past experience of investigating ‘physical’ crime to manage crime scenes with digital traces. The perceived challenge concerns detecting and ascribing digital traces to their specific meaning under the context of a crime. However, the newly emerging and evolving criminal conduct in cyberspaces challenged investigators’ current knowledge and barriers them to interpreting the generation of digital traces.

Acknowledgements

I would like to appreciate for the anonymous participants and officers who helped me in my field research.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Notes

1 These rules are included in the Decision on Strengthening Network Information Protection. This decision passed by the Standing Committee of China’s National People’s Congress (NPC, China’s top legislative body), in 2012. http://www.gov.cn/jrzg/2012-12/28/content_2301231.htms.

2 In 2016, Supreme People's Court, the Supreme People's Procuratorate, and the Ministry of Public Security issued ‘the Provisions on Several Issues concerning the Collection, Taking, Examination, and Judgment of Electronic Data in the Handling of Criminal Cases’. Article 2 clarifies the investigation departments can conduct digital forensic examination, and Article 8 clarifies the examination transcript is required.

Appendix

Table A1. Demographic information of participants in interviews.

No.	Experience in police departments	Leader position	Code of location	City tier	Categories of investigation	Administration level
A1	3–5	No	Province 1	T2	Criminal	Local
B1	3–5	No	Province 2	T1	Criminal	Local
C1	3–5	No	Province 3	T3	Criminal	Local
B2	5–10	No	Province 2	T1	Criminal	Local
B3	10–15	No	Province 2	T1	Criminal	Local
D1	20–25	No	Province 4	T1	Financial	Municipal Bureau
E1	3–5	Yes	Province 5	T4	Criminal	Local
E2	20–25	Yes	Province 5	T4	Criminal	Local
E3	3–5	No	Province 5	T4	Criminal Cybercrime and Digital Evidence	Local
F1	3–5	No	Province 5	T4	Criminal	Local
F2	3–5	No	Province 5	T4	Criminal Cybercrime and Digital Evidence	Local
G1	15–20	Yes	Province 5	T4	Criminal	Local
G2	15–20	Yes	Province 5	T4	Criminal	Local
H1	3–5	No	Province 5	T4	Cybercrime	Municipal Bureau
H2	15–20	No	Province 5	T4	Criminal	Municipal Bureau
H3	3–5	Yes	Province 5	T4	Cybercrime	Municipal Bureau
H4	3–5	No	Province 5	T4	Criminal	Municipal Bureau
H5	25+	Yes	Province 5	T4	Criminal	Municipal Bureau
J1	15–20	Yes	Province 5	T4	Criminal	County Bureau
K1	3–5	Yes	Province 5	T4	Forensic Office	Municipal Bureau
K2	20–25	Yes	Province 5	T4	Forensic Office	Municipal Bureau
L1	20–25	Yes	Province 5	T4	Legal Office	County Bureau
L2	20–25	Yes	Province 5	T4	Criminal	County Bureau
A2	5–10	No	Province 1	T2	Cybercrime	Provincial Bureau
A3	20–25	Yes	Province 1	T2	Cybercrime	Provincial Bureau
A4	3–5	No	Province 1	T2	Criminal	Local
A5	3–5	No	Province 1	T2	Criminal	Local
A6	5–10	No	Province 1	T2	Criminal	Local
A7	3–5	No	Province 1	T2	Criminal	Local