The Mental Model That Built Your Career May Not Transfer
There's a thought experiment I put to my class when we get to this lecture. You have a hard drive. You have a forensic examiner who has spent ten years getting evidence into courtrooms—excellent documentation, clean chain of custody, conservative language, airtight methodology—and you drop that examiner, no briefing, into an intelligence environment where the target is active right now, the drive just came in from a field collection, and the team needs whatever you can surface in the next six hours. Does the examiner's experience help or hurt? The honest answer is both—and the ratio depends entirely on whether they can shift the mental model before touching the keyboard, because ten years of excellent instincts will not save you if you're optimizing for the wrong mission.
Judge Richard Posner, in Uncertain Shield, drew a distinction that I think is the cleanest entry point into this problem. Law enforcement performance, he wrote, is easily measurable: arrests, convictions, and cases closed. Intelligence performance is not. Law enforcement investigates crimes that have already been committed. Intelligence wants to surveil, analyze, and understand—oriented toward what is happening right now and what might happen next—and these are not the same job, not by a long way.
The "iron triangle" framing makes this concrete. In business, we say "good, cheap, and fast—pick two." What I've found in digital forensics (called "media exploitation" in Intelligence parlance) is a parallel: law enforcement, Intelligence, and commercial work lives inside a tension between speed, factual detail, and analytic depth. In law enforcement, the two you protect are factual detail and analytic depth—your report has to survive cross-examination, a Daubert challenge, and a defense attorney who has read it more carefully than you have in the week before trial. Speed is what you trade away, and a months-long examination is often appropriate because the findings have to hold up in court. Sometimes you might not even see the evidence in the lab for six months after it was obtained in the field. In Intelligence, the vertices shift: speed and analytic depth are what you protect. Recovering 60 to 80 percent of the data in six hours is often the right call when the alternative is 100 percent of the data back after the window for action has closed. Timeliness is a quality dimension in intelligence work—not a convenience, and not an excuse for sloppiness—but a genuine measure of whether the work serves its purpose.
That framing matters because it redefines what "thorough" means in each context. A law enforcement examiner who issues a partial report, or one that gets corrected and reissued, has created a serious professional problem. An intelligence examiner who withholds actionable findings because the examination is not complete yet has committed a different kind of failure—measured in missed opportunities rather than suppressed evidence. You need your report to be "left of boom," or it's essentially useless. Intelligence products are living documents, updated as understanding develops. Law enforcement reports are sealed, defensible records. Both approaches reflect the discipline appropriate to their purpose, and neither is a degraded version of the other.
The language itself signals the difference. Law enforcement reports hedge carefully: "is consistent with," "may indicate," "could potentially be." That phrasing is armor, not imprecision; it protects the examiner from the gap between what was found and what was claimed. Intelligence reports shed most of that hedging. When an analyst is 80 percent confident, the report says "is." The reader needs to make a decision, and language that reads like a deposition does not serve that purpose. Reports can be issued incrementally, corrected, and reissued as understanding evolves—in law enforcement, that sequence describes a catastrophic failure; in intelligence, it describes an honest process.
The legal terrain shifts entirely in intelligence work. No search warrant, typically no defense attorneys, and standard operating procedures slimmer than those in most law enforcement labs. FISA—the Foreign Intelligence Surveillance Act, enacted in 1978—is the governing framework for electronic surveillance against U.S. persons. Its history is worth understanding because it explains the shape of the current rules.
Congress passed FISA in response to the surveillance abuses exposed in the Watergate era: warrantless wiretaps, unauthorized surveillance of political opponents, and federal agencies turned on domestic targets without any judicial check. The law created a distinct legal architecture—a specialized court, a probable cause standard, and defined categories of who could be targeted—to put structure around intelligence collection inside the United States. The Patriot Act in 2001 loosened the purpose requirement; the USA Freedom Act in 2015 pulled back on bulk collection and required the FISA court to publish novel legal interpretations. If you work FISA-related cases, you generally will receive a formal agency briefing before you touch any data.
The last thing I tell the class on this material is about professional courage, and it has nothing to do with courtrooms. In an intelligence environment, you may be the only person who has seen the raw data on the submitted media. The agency around you is large, compartmented, and full of people with strong views about the targets they're tracking—views formed without access to what you just examined. That institutional weight will sometimes push against your findings, and the push will be quiet, political, and persistent rather than adversarial and formal.
The professional discipline is simple in principle. Stand behind what you found. Report it accurately. Let the analysts argue about what it means; that is genuinely their job. Your job is to ensure they're arguing about real data.
This post is the tenth in a series based on my course, DFOR 671: Topics of Ethics and Law in Computer Forensics, that I have taught at George Mason University for the past fifteen years. With one article remaining, I'll next look at the ethical, legal, and practical issues that surround the use and investigation of AI from the digital forensic practitioner's point of view.
First published on LinkedIn.