A recent industry benchmark report shows that smartphones have become a critical evidence source in 97% of criminal investigations. As reliance on Digital Intelligence (the ability to access, manage and analyze digital data to accelerate investigations) grows, many agencies are transforming the way they conduct investigations by placing greater emphasis on digital data management and analysis to move cases forward.

Tuan Liang Lim is the Director for Digital and Information Forensics for the Home Team Science and Technology Agency (HTX), an arm of the Ministry of Home Affairs that was created to handle everything relating to technology and digital intelligence in 2019. In a recent interview, Director Lim talked about the transformation that is taking place within the police force saying, “the traditional model of investigation is going to be overturned,” with DI providing the driving force behind investigations. The key to making the DI equation work, however, is joining analytics and open-source information together.

Lim Tuan Liang (left) showing then president of Singapore, Tony Tan Keng Yam, the UFED Touch 2
Lim Tuan Liang (left) showing then President of Singapore, Tony Tan Keng Yam, the UFED Touch 2 (Photo: HTX)

“In the past,” Lim said, “[when] we arrested someone and seized their devices, we thought everything was there. But that’s not true anymore. If they [criminals] are using cloud services, they might not store anything on these devices… So it becomes an undeniable reality that you will have to join the two pieces.”

His department is moving rapidly in that direction as part of a strategy they are executing with Cellebrite that will ultimately provide centralized data access and management from anywhere while empowering investigative teams with the latest analytics solutions. Arriving at this point, however, has taken time and getting people like Director Lim in the right positions.

“…the big challenge is the exponential growth in the way that people are using digital devices [and] services.”

Lim started his career with the Singapore Police right out of college. “I joined as a uniformed officer,” he said, “carrying guns, doing patrols, doing investigations, and catching the bad guys.” That notion of “catching bad guys” has been at the core of Lim’s journey to becoming a digital investigator. From early childhood, he had a natural passion for technology, fed by an uncle who handed down an old Apple II computer to Lim when he was a boy.

Senior Forensics Examiner Mohamad Ridzuan Bin Yusop using the Chip Off machine to recover data from damaged mobile devices. (Photo: HTX)

“I think that started my journey,” Lim said, “coding in Basic, and then moving on to future generations of computers, and eventually to the mobile devices we have today, which are more powerful than anything we had then.”

His interest in investigations naturally led him to forensics where he eventually became head of the digital forensic lab for the Singapore Police, a position he held for close to nine years before his move to HTX.

“…[It’s] the fact that we have data [that has a] direct impact on the lives, livelihoods, and security of everyone, not just within our borders, but even globally.”

HTX—A New Model for Security

HTX’s unique mission harnesses science and technology as the engines to drive nationwide security. As defined on their website:

“HTX is the world’s first Science & Technology agency that integrates a diverse range of scientific and engineering capabilities, to innovate and deliver transformative and operationally-ready solutions for homeland security…Our shared mission is to amplify, augment, and accelerate the Home Team’s advantage to secure Singapore’s future as the safest place on planet earth.”

In 2019, Lim was asked to become the head of the Digital & Information Forensics Center of Expertise—one of 14 centers within HTX that range from Cybersecurity to Sense-making & Surveillance.

Each center serves not only the police but all of the Ministry’s other agencies.

Work From Anywhere at Anytime

While HTX and the Center of Expertise is a model of forward-thinking, developing a new workflow and providing a secure system that allows investigators to work remotely has been a big challenge.

“Right now, we are still in a pretty manual workflow,” Lim said. And I think that’s typical of a lot of police forces.”

The recent pandemic, however, forced his department to rethink their policing strategy. Everything, from replacing original signatures on forms with e-signatures to looking more broadly at database access and management, has been reengineered.

“One of my long-term goals is to enable my officers to work anywhere at any time,” Lim said. The onset of the pandemic was the game-changer. Working from home was the only viable option, but Lim realized he could not do that as effectively because his lab was set up on a secure network that could not be accessed from anywhere but inside the lab itself.

Lim wants to reduce the number of people that need to be in the lab at any given time. To do so, however, he saw the need to build a system that houses all the necessary data and tools for analyzing cases in a centralized hub that can be accessed from anywhere.

“It’s time for a major overhaul,” he said. “I think we [can] probably clear the security concerns. Now it’s just implementing the infrastructure and getting everything onto that platform to make it happen.”

Lim’s new platform will seamlessly integrate a number of solutions his department is already using such as Cellebrite Premium to access data from iOS and high-end Android devices, Cellebrite Responder Kiosk to empower frontline officers to securely collect digital data and surface insights from devices in the field, and UFED Cloud to access data that is not stored on devices.

Senior Forensics Examiner Khairul Anwar Bin Ishak using the Responder Kiosk to collect and examine data from the mobile phone. (Photo: HTX)

It’s all part of his larger vision to take the pressure off the lab by extending the workflow “outside.” Pushing the workflow out to other team members also expedites the data-gathering process while increasing efficiency, ultimately allowing his team to find actionable intelligence more quickly.

The final challenges are data management and incorporating open-source intelligence (OSINT) into his data analytics workflow.

“…. So, building those capabilities, [and] having equipment around to support new devices, is really key to keeping up with investigation challenges.”

Managing the Data Mountain

Like many agencies, HTX is dealing with thousands of devices each year. And as storage capacities on mobile phones increase to a terabyte and more, managing the mountains of data that can be associated with even a single investigation can be a major challenge.

“Right now I think we are [examining] about 4,000-plus devices a year,” Lim said, “but I think this [number] is artificially suppressed because we can’t handle more than that meaningfully at this point. We hope to bring those numbers up significantly in the next couple of years.

“For my domain, Digital and Information Forensics,” he continued, “the big challenge is the exponential growth in the way that people are using digital devices [and] services.” Obviously, that generates a huge amount of data, so the challenge becomes how to manage this data to get the most actionable insights out of it.

“We have a lot of other technical challenges, because of the amazing number of devices that you have out there, [and] the diversity now. It’s not just the number, it’s that there are so many different kinds…. So, building those capabilities, [and] having equipment around to support new devices, is really key to keeping up with investigation challenges.”

Ridzuan performing the removal of the storage chip from the logic board. (Photo: HTX)

Linking Analytics To Open-Source Intelligence

Tying analytics and OSINT together is the final piece of the puzzle Lim is fitting into his new investigative system.

“To have a complete investigation, you need to have [access to] both the devices and everything else that is out there on the open Internet. To do that, we need to integrate the two pieces in a way that should be, [seamless] to the investigator.”

Lim’s sees the platform he is building with Cellebrite as providing a springboard for investigators to instantly access anything they need to corroborate with online sources in what he calls “fingertip access.”

As Lim sees it, “He [the investigator] should just need to click a few buttons for that request to be sent up and for all that information to be gathered [to enrich his] case, so that he can then make the final analysis and come to the conclusion for the case itself. Today, these two pieces are rather separate and done individually.”

In his larger vision, Lim sees the benefits of having all of the data and tools for working on DI-driven cases in one central core as the key to driving collaboration between his investigative team members and across the many departments that HTX supports.

Ultimately, being able to access, analyze, manage, and visualize data in one centralized workflow to drive context-based decision-making across a wide range of different case types will increase speed and efficiency to solve more cases faster. It will also allow his team to better serve the many law enforcement agencies outside of his ministry that his department can aid.

Close-up shots of Ridzuan performing the removal of storage chip from the logic board (Photo HTX)
Ridzuan performing the removal of storage chip from the logic board (Photo HTX)

Given the large data volumes, investigators are working with and all that they need to make sense of takes the right kind of system. Getting that system dialed in can’t be rushed, which is why Lim and his team are building their centralized platform in stages and testing everything as they go. As he explained, “I’m also looking at using the pieces like microservices architecture and making sure that they all work together seamlessly to give you what you want.

How close is he to achieving his dream of a single unified platform? “In three years’ time we hopefully will have moved 80% to 90% into a cloud-based environment,” Lim said, “[with] all our data sitting on …a data lake, the Cloud, or a server. And because of the way the infrastructure is set up, we will be able to plug and play any new technology, algorithm, or tools into our workflow instantly and make that all part of the [processing change] to provide the information we need.

AI will play a big role in making humans “smarter” by pointing investigators to information they might have missed due to the sheer volume of data that must be parsed in each case, but Lim is adamant that in working with Cellebrite to refine his platform, once investigators can visually see the entire case, they will ultimately make the call on what evidence to put forward based on their judgment. Being able to make sound judgement calls is one of the reasons Lim places such strong emphasis on training.

“Just-In-Time” Training For Success

Lim does two types of training with his group—technical training for examiners and frontline training for investigators and officers so that they know how to deal with digital devices at a crime scene. Currently, he’s ramping up to train 1500 officers.

“We believe in continuously refreshing [tech] knowledge,” Lim said “and trying to deliver that training to each of our officers when they need it—something like a “just-in-time” type of model…If you learn something before you need it, yes it’s good, but you’ve probably forgotten most of it by the time you get to apply it. When you can get the training that you need just in time to do that job that you need to do, I think that [matches up well].”

At present, Lim is working with Cellebrite on an app that will allow officers to access training any time rather than having to refer back to notes from previous classes that may be outdated. It’s a work in progress, but it’s another way that he sees digital technology being able to support his officers.

Training is also a key part of Lim’s recruitment-and-retention strategy. HTX is competing for top talent just as large tech companies are. And just like Google and Microsoft, creating an environment where people can be shown a clear growth path and reassured that what they’re doing has great social significance is paramount.

Creating The Best Work Environment On Earth

  “One of the quotes that really resonates,” Lim said, “is by Richard Branson: ‘Train people well enough so they can leave, treat them well enough, so they don’t want to.’ You don’t want people that don’t leave or [feel] stuck with you because there is nowhere else they can go…That’s why we train them to the best of our ability. Obviously, it means that they will be very attractive to everybody else out there. But [if] you give them the greatest job satisfaction on earth (or at least in Singapore),…they will stay.”

Our last question about what motivates him to get up every morning to do what he does drew a giggle from the Director who said, “Partly it’s all that new technology that I get to put my hands on, to try out, and to really live on the edge. The other part is [enjoying] the same job satisfaction as all the other officers that work in my unit. [It’s] the fact that we have data [that has a] direct impact on the lives, livelihoods, and security of everyone, not just within our borders, but even globally.”