Wearable Technology for Crime Scene Examination: distributed cognition and naturalistic decision making

Motivation – To explore the domain of crime scene examination as a form of distributed cognition and naturalistic decision making and to inform design of novel technologies. The ‘digitisation’ of Crime Scene Examination is an ongoing activity throughout the world. This process involves the use of portable computers to record scene details and prepare reports, the use of digital photography to capture images of the scene, the use of image analysis for the recognition of fingerprint and footwear marks, the use of ‘lab-on-a-chip’. Each development implies changes to working practice and higher expectations of how evidence is captured and processed. Research approach – A review of several studies within the framework developed in this paper. Findings/Design – The results suggest colour of the design as a possible underlying factor for the significant correlations found between personality traits and design preferences. Research limitations/Implications – Crime Scene Examination is distributed in three senses: in terms of attention between the activities of searching, recovering and reporting; in terms of the interaction between examiner and environment; in terms of the personnel involved in the evidence chain. Originality/Value – The research contributes to the understanding of crime scene examination and to distributed cognition by focusing on the ways in which evidence is identified and considered. Take away message – Wearable computers can enhance crime scene examination by integrating the tasks of searching, retrieving and recording of evidence in a manner that is not possible with laptop computers. In order to develop such technology, the role and activity of the Crime Scene Examiner must be considered as a form of distributed cognition


INTRODUCTION
The notion that cognition can be 'distributed' has been developed over the past couple of decades (Artman and Waern, 1999;Artman and Garbis, 1998;Busby, 2001;Flor and Hutchins, 1991;Furness and Blandford, 2006;Hollan et al., 2002;Hutchins, 1995a,b;Hutchins and Klausen, 1998;Perry, 2003;Rogers and Scaife, 1997).A primary assumption of 'distributed cognition' is that objects-in-the-world play a role in supporting, structuring and aiding the activities of cognition.One could draw an analogy between this claim and the debate about 'broad' and 'narrow' mental content in Philosophy.The notion of 'narrow' content might assume that a person's belief about something could be defined entirely by their intrinsic characteristics (and would not change with any changes in their environment).The notion of 'broad' content, on the other hand, is inextricably tied to the person's environment.For example, Putnam (1975) contrasted beliefs about the concept 'water' between Earth and 'Twin Earth'.Twin Earth was exactly the same as Earth, with the exception that the chemical properties of that element termed 'water' were different (although the observable properties were the same on Earth and Twin Earth).Putnam's (1975) claim was that, given identical individuals on Earth and Twin Earth, when either spoke about 'water' they would be referring to something different.This means that the intrinsic characteristics of these two identical individuals would not be sufficient to determine the meaning of the word 'water', but that there needs to be some reference to external environment.This leads Putnam (1975) to make the well-known assertion that "...meanings' just ain't in the head." (p.227).
In terms of the relationship between technology and cognition, one can posit a 'weak' and 'strong' view.A 'weak' view of the Distributed Cognition argument might claim that what is being distributed is the collection of objects upon which the act of cognition can be focused.This would require objects-in-the-world to play a fairly passive role in the process of cognition and for them to function as vehicles for the storage or representation of information.Thus, the design of artefacts that are used in a work environment become changed by their use, and these changes provide cues for subsequent use (Bang and Timpka, 2003;Nemeth, 2003;Seagull et al., 2003).The artefacts allow users to off-load information (Scaife and Rogers, 1996) and also a record of previous activity.In this version, the objects have their states altered by the actions that their users perform on them, e.g., through note-taking, folding or other markings.Furthermore, not only do these objects provide a means of recording and storing information, but their design affords (or influences) the actions of the person using them.Thus, as Norman (1988) points out, the humble shopping list could structure the shopping task by requiring the person to only buy what is written on the list; the act of writing the shopping list could require the person to engage in a set of planning activities to decide what to include; the items of the list could influence the route taken through a supermarket.On other words, the object provides cues for a range of activities, and the activity that is performed is likely to arise from the interaction between the object, the environment it is being used, the disposition of the person etc.
The 'strong' view of Distributed Cognition, posits that it is the tasks involved in cognition which are being distributed.In this view, one would expect objects-in-the-world to be more active and capable of either performing, or at least participating in, information processing tasks.For example, Hutchins (1995b) famously speaks about the ways in which the flight-crew and their instruments work together to monitor the speed at which an aircraft is flying; his assertion is that this knowledge does not reside in the head of one specific individual, but is derived from the collection of information that is available in the cockpit.Perhaps, a point to note here is that, ultimately, there needs to be some 'cognizing entity' that is capable of combining the various bits of data into a coherent 'whole' and that this requires a set of mental capabilities that are uniquely human.
Naturally, there is a blurring of the edges between these views, e.g., a pocket calculator can store and represent information and thus support the cognitive activity of its user ('weak' view), but the calculator could also be programmed to perform a complex statistical test on the basis of data supplied by the user; in this latter example, the calculator is not simply supporting the user's cognitive activity but is performing 'cognitive' activity in its own right ('strong' view).Of course, in order to accept the 'strong' view described here, one must accept that 'cognition' can be reduced solely to the processing of information and that the steps involved in information processing can take place outside the head (although cf. the earlier consideration of 'broad' versus 'shallow' content).If this is true, then many programmable artefacts (whether physical devices like calculators or software 'agents') can be claimed to be, in a limited sense, capable of cognition.This assumes that 'information processing' (which is the generic term applied to the activity of these devices) is somehow more than performance of defined routines in response to specific data.
Both views raise questions that relate to the symbiosis between person and technology and the manner in which cognition becomes a matter of sharing tasks.From the 'weak' view, objects-in-the-world can be used to 'off-load' some of the tasks that the person needs to perform, e.g., the person could write brief notes or take photographs to offload the burden of remembering a scene.From the 'strong' view, a software Agent could be tasked with searching for instances of a type of information and report back to the person when it has found something.
Whichever approach is followed, there are additional issues relating to the tasks involved in managing this symbiosis, e.g., when should the person stop performing an activity in order to perform the 'off-loading' tasks, or when should the Agent interrupt the performance of an ongoing activity with the results of its search?Neither of these issues are trivial to solve, because both depend on the context in which the activity is being performed and the complexity of the cognition that the activity requires.From this perspective, the use of technology to support 'distributed cognition' could require the explicit ability (in the technology) to recognise what a person is doing, when interruptions are permissible, how much information to provide etc., all of which places the locus of control in the technology.An alternative perspective, and one explored in this talk, asks how this could become implicit in the three-way interaction between person-environment-technology.
From this brief discussion, one can assume that objects-in-the-world can play an important role in cognition.Often these objects-in-the-world are purpose-built to support specific cognitive activities, or are adapted from existing objects.Researchers would then either focus on the design of such objects, and their ability to support cognition or at ways in which activities result in the modification of objects.Crime Scene Examination, I argue, represents a special case, in that the objects-in-the-world to which the person attends have been neither designed nor adapted to suit a specific cognitive activity.Rather, the objects have to be discovered by the person and then interpreted in terms of their relevance to the task of gathering evidence.In this manner, the tasks of discovering objects-in-the-world that could have evidential value can be considered a form of recognition-primed decision-making (Klein et al., 1986;Klein, 1997).This raises the main question for this paper, i.e., how can technology support such activities?

CRIME SCENE EXAMINATION
It is tempting to imagine the role of the Crime Scene Examiner (CSE) as being akin to Sherlock Holmes or the portrayals on television programmes such as CSI.The reality is somewhat different.In the first place, the CSE is part of a much larger investigative team, each member of which has their own skills and roles (Smith and Baber, 2008).Thus, there is a potential demarcation between roles within this extended team.Having said this, the nature of this demarcation has been subject to significant shifting with the ongoing digitisation of Crime Scene Examination.For example, there used to a specific role of Crime Scene Photographer whose function was to capture and process images of the crime scene (either prior to evidence recovery or at stages during the recovery process, depending on the nature of the crime).However, with the growing use of digital cameras by CSEs, this role has (in some Police Forces) changed.Whether or not similar changes might arise in terms of specialised analysis of fingerprints, footwear marks, DNA and other evidence is a matter of continued debate.For the time being, these specialised analyses are generally performed by Forensic scientists rather than by CSEs.This means that one of the primary role of the CSE is the recovery of evidence and its transportation in a usable state to the Forensic scientist.How this recovery and transportation is performed, and how closely the Forensic scientist and CSE cooperate depends very much on the nature of the crime being examined.For much of our work, we have focused on what is called 'Volume Crime', i.e., robbery, burglary etc. (as opposed to 'Serious Crime', i.e., murder, rape, kidnapping etc.).In Volume Crime, it is likely that the recovered evidence is passed on to the Forensic Scientist via a third party (sometimes called the 'Evidence Manager').This means that any information pertaining to that item needs to be carefully and comprehensively recorded by the CSE prior to depositing with the Evidence Manager.It is this combined process of recovery, storing, labelling and transportation of evidence that forms the basis of several forms of computer-based CSE support, i.e., evidence management systems.What is particularly poignant, from the point of view of Distributed Cognition, is that the process of 'find-recover-analyse-interpret-conclude' is divided between two or more people, with quite limited communication between them.As an example of why this is problematic, consider a finger-mark left on a window.This mark might not be detailed enough to form a print, but could indicate whether the window has been forced up or whether someone climbed down the window -knowing the orientation of the mark on the window can help decide how best to analyse it, but this might not have been provided in the evidence log.Thus, it is possible to argue that the scene and the evidence it contains 'afford' different responses from different individuals, and these affordances can influence the decision-making and analysis at different stages during the investigation (Baber et al., 2006).

Inspection and Expectations
In their study of Crime Scene Examination, Schraagen and Leijenhorst (2001) recorded verbal protocols of the examination of a reconstructed crime scene.They suggested, for the analysis of these protocols, that the experienced Crime Scene Examiner will develop a narrative of the crime, e.g., considering how a person might have gained access to the building, what path they might have followed, what actions they might have performed etc.This narrative would probably be intertwined with the search activity, such that the narrative would influence the search and the search would influence the narrative.In a pilot study that used a head-mounted eye-tracking system, we asked three experienced Crime Scene Examiners to inspect an office in which a theft had purportedly occurred.We asked three Undergraduate students to search the same room under the same conditions.Of the many obvious and striking differences between the two sets of recordings, we noted that the students had a tendency to search only around locations that they believed to have links with stolen items -and so their narrative was focused solely on the loss of objects.The Crime Scene Examiners had a far more detailed narrative to guide their search and, as the stills from one recording shown below illustrate, spent a substantial part of their time looking at the door and noting possible evidence that could be recovered, e.g., blood stains near the latch, tool marks made by a chisel on the door frame, a footprint on the outside of the door.
Discussion with these Crime Scene Examiners implied that experience played a key role in deciding where to look for evidence and how best to examine the scene.For volume crime, the Crime Scene Examiner might walk the scene with the victim in the first instance, and then return to key locations to look for possible evidence.There was some debate as to what should be the first location to search.Standard practice might say that one begins with the Point of Entry and examines that thoroughly, then tries to follow the likely path taken through the house by the thief.An alternative perspective suggests that the thief might be very careful when entering the premises, taking extra care not to leave marks on the Point of Entry, but might then either relax this caution or become more stressed when they start to collect items to steal (this might involve removing gloves in order to open jewellery boxes for instance), and that the first point out to be the room in which most items were missing.There is no 'correct' answer to this but the fact that the matter could be debated highlights how the approach will vary in terms of context and experience.
Two further factors in the 'distribution' of Crime Scene Examination arise from the 'civilianisation' of CSE activity, i.e., the recruitment of personnel to this function from outside the Police Force, and the establishment of specific CSE units, i.e., outside the operation of separate Police stations.While both of these factors can be related to imperatives of economics and efficiency gains, they have a bearing on how knowledge of criminal behaviour is shared and applied.For example, an understanding of criminal behaviour, gained over years of policing, could help interpret evidence.This could be dealt with through the training and exposure of new CSE personnel, or through the integration of CSE activity with other police activity.This relates to the second point, i.e., removal of a CSE from police stations, which implies the need for a means of sharing experiences and knowledge.Thus, if there is a set of similar cases in an area (say a string of burglaries with similar ways of gaining access to a building), then one would expect a link to be made between them.However, if each case is investigated by different individuals, then it might not always be possible to explore such links.We have explored the potential application of Case-Based Reasoning (CBR) to such a scenario.As an investigation proceeds, we take elements from the report that the CSE is compiling and use them to form a 'case'.An example is shown in figure 2. The information is compiled directly from the CSE reporting tool, which is described below.The point is that the user will have a 'case' automatically compiled during the course of an examination.The information that has been collected then links to an ontology relating to types of crime.If there is sufficient similarity between the contents of the new 'case' and others stored in the system, then the user could be prompted to consult these other cases.Thus, the CBR could provide a means of sharing experience between CSE in order to aid in identifying associations between 'cases'. .

Evidence Recovery and Sharing
As mentioned previously, one requirement of the Crime Scene Examination process is to select items that could be of evidential value.This means not only finding visible items, but also preparing surfaces so that less visible items can be revealed.Figure 3, for instance, shows how a surface can be prepared to lift fingerprints.2005) highlights how their interpretation could be biased with the provision of additional contextual information.In this study, contextual factors were manipulated by the story and photographs that were used to explain the source of the fingerprints, e.g., crimes with no physical harm to the person versus crimes with extreme physical harm.The study showed that in cases where the fingerprints were unambiguously different, there was little effect of context.When the fingerprints were ambiguous, i.e., when the certainty as to whether they were the same of different decreased, then the contextual factors seemed to play a role in increasing the likelihood of seeing a match.However, this effect was only observed for the context in which extreme physical harm featured in the background story.The study suggests that in cases where there might be some uncertainty as to whether fingerprints match and where the crime is extreme, that matching might be influenced by context.This also suggests that, while the use of a narrative to guide the collection of evidence might be beneficial, it can also bias interpretation and, by implication, search.This raises the potential (and, perhaps, often unexplored) question of how recognition-primed decisions can become biasing rather than supporting, particularly in terms of expectancy bias.
Once evidence has been recovered, it is placed in appropriate bags (or containers), labelled and passed on the Forensic Laboratory for further analysis.This step in the process requires some means of maintaining accurate records of who has handled the evidence, as well as the accumulation of the results of analyses.This relates to a point made earlier, that the 'distributed' nature of the Crime Scene Examination process can make this process somewhat disjointed, in that it is not uncommon for the Forensic Scientist in the laboratory to have very little information on the item recovered.One could make a strong argument that this lack of information helps an analysis to be as objective as possible, by focussing only on the item at hand (and avoiding the potential for bias that Dror et al. (2005) demonstrated).On the other hand, it might be useful to have some knowledge of the item in situ, so as to decide how best to conduct analysis.If the Forensic Scientist had recovered the item herself then such information would be recalled by her, but when it is delivered in a batch of bags then such information is not obviously available.

Reporting and Disclosure
The final decision of the relevance of an item of evidence is made in Court during the hearing.However, an initial assessment will be made (in the UK) by the Crown Prosecution Service which will evaluate the evidence that is being presented in support of a case and decide whether it is suitable.This raises one of the key dilemmas in evidence recovery and relates to the Laws of Disclosure.Basically, these Laws of Disclosure state that anything that has been collected as part of the investigation can be made available to both Prosecution and Defence (even if it is not presented at Court).
This raises two issues for this discussion.First, the adversarial nature of the Justice System (in the UK and many other countries) means that the 'distributed cognition' involves not only cooperation and collaboration (in terms of several people contributing to a common goal) but also conflict (in terms of two parties attempting to prevent each other from achieving their goal).I am not sure that there are many other areas of distributed cognition research which come up against this problem (although, of course, one can imagine many examples from military and law enforcement).Second, the process often involves a number of different forms of analysis and interpretation.In Baber et al. (2006) we referred to these forms as formal and informal narratives, and suggested that there was a continual development of narratives, along several lines, over the course of an investigation and that very often these narratives might not connect.In a sense, Crime Scene Investigation involves sets of ad-hoc teams pursuing independent goals with quite limited overlap (Smith et al., 2008).

Developing CSE Technology
The technology we have been developing to support Crime Scene Examination in based on wearable computers (Cross et al., 2007).This differs from contemporary, commercial products in two key ways.First, by using a wearable computer rather than a laptop or other hand-held device, we are seeking to free the Crime Scene Examiners hands as much as possible to allow them to conduct search and recovery.Second, as a result of providing 'hands-free' access to a computer, we are designing to support seamless integration of reporting with search and recovery.Thus, rather than having the task of reporting interrupt the primary tasks of search a scene and recovering evidence, our intention is to allow these activities to occur in parallel.This also places the locus of control on the Crime Scene Examiner, rather than on the technology or on the process they are meant to follow.
Figure four shows images from a comparative evaluation of the wearable kit (worn in a vest) and a version of the same application running on a tablet computer.This was intended to compare the needs to use one's hands for data entry (on the tablet) with the hands-free supported by the wearable computer.

Figure 4: Comparing Wearable and Tablet Computer platforms of a Crime Scene Examination application
A full description of the trial and its results can be found in Baber et al. (in press).The main changes that we noticed during our trials were associated with the time and quality of the recording process.In general, using computers sped up the process but did not adversely affect the quality of the recording.A more important finding relates to the manner in which the wearable computer supported concurrent activity (see figure five).This is interesting in that, while the tablet computer also resulted in faster transaction time, the manner of interaction was similar to the paper process.This implies that the tablet computer helped to speed up the 'clerical' aspects of recording but did not necessarily alter the manner in which activities were performed.The wearable computer, on the other hand, not only led to faster performance but also changed the nature of the work.

CONCLUSIONS
The paper suggests that Crime Scene Examination is distributed in three senses.First, there is the distribution of attention between the activities involved in searching, recovering and reporting.Our prototypes have been designed to allow concurrent performance of reporting with the primary tasks of search and recovery.Second, there is the distribution of cognition between CSE personnel and the scene itself; the manner in which the scene is examined provides hints and cues to what evidence to recover, and interrupting this process (through the need to complete lengthy reports) could disrupt this process.Third, there is the distribution of information between CSE personnel and other people involved in the investigation.By providing real-time digital records of the examination, and allowing shared annotation of these records it is possible to support collaborative working.
In terms of the relationship between technology and distributed cognition, the work reported in this paper covers both the 'weak' and 'strong' views of distributed cognition outlined in the introduction.From the 'weak' view, it is argued that the training, knowledge and experience of Crime Scene Examiners allow them to use the environment and the artefacts within it as a resource-for-action in a manner that might be alien to the non-expert.In this way, the Crime Scene Examiner will not only search for specific artefacts but also be able to identify locations which could yield nonvisible materials, e.g., places to check for fingerprints, DNA and other evidence.The use of eye-tracking and verbal protocol from crime scene examination show how the approach to searching a scene differs with experience.From the 'strong' view, the development of wearable technology and case-based reasoning to help structure the reporting and interpretation of evidence from a crime scene shows how it is possible to integrate technology with current working practices in a manner that is not only non-intrusive but can also be integrated into work practices to change the manner in which work is performed.

Figure 1 :
Figure 1: Stills taken from head-mounted, mobile eye-tracker worn by a Crime Scene Examiner

Figure
Figure 2 : New Case

Figure 2 :
Figure 2: Crime Scene Examiner, wearing head-mounted display for a wearable computer and head-mounted web-cam, dusting a window-sill for fingerprintsWhile there are clear procedures in place for the recovery and analysis of finger marks, work byDror et al. (2005) highlights how their interpretation could be biased with the provision of additional contextual information.In this study, contextual factors were manipulated by the story and photographs that were used to explain the source of the fingerprints, e.g., crimes with no physical harm to the person versus crimes with extreme physical harm.The study showed that in cases where the fingerprints were unambiguously different, there was little effect of context.When the fingerprints were ambiguous, i.e., when the certainty as to whether they were the same of different decreased, then the contextual factors seemed to play a role in increasing the likelihood of seeing a match.However, this effect was only observed for the context in which extreme physical harm featured in the background story.The study suggests that in cases where there might be some uncertainty as to whether fingerprints match and where the crime is extreme, that matching might be influenced by context.This also suggests that, while the use of a narrative to guide the collection of evidence might be beneficial, it can also bias interpretation and, by implication, search.This raises the potential (and, perhaps, often unexplored) question of how recognition-primed decisions can become biasing rather than supporting, particularly in terms of expectancy bias.Once evidence has been recovered, it is placed in appropriate bags (or containers), labelled and passed on the Forensic Laboratory for further analysis.This step in the process requires some means of maintaining accurate records of who has handled the evidence, as well as the accumulation of the results of analyses.This relates to a point made earlier, that the 'distributed' nature of the Crime Scene Examination process can make this process somewhat disjointed, in that it is not uncommon for the Forensic Scientist in the laboratory to have very little information on the item recovered.One could make a strong argument that this lack of information helps an analysis to be as objective as possible, by focussing only on the item at hand (and avoiding the potential for bias thatDror et al. (2005) demonstrated).On the other hand, it might be useful to have some knowledge of the item in situ, so as to decide how best to conduct analysis.If the Forensic Scientist had recovered the item herself then such information would be recalled by her, but when it is delivered in a batch of bags then such information is not obviously available.

Figure 4 :
Figure 4: Concurrent Activity when using the Wearable Computer