Scientific and Professional Integrity in Digital Forensics and Cybersecurity

Quality, independence, and verifiability in Digital Forensics and Cybersecurity

A civic research initiative examining scientific rigor, professional integrity, and safeguards that protect rights. DF Integrity examines the conditions that allow technical work to be documented, professional judgment to remain independent, and conclusions to be verified, including when artificial intelligence is used. The project considers methodological quality, transparency about relevant interests, and the possibility of technical debate free from influences unrelated to the merits. At its heart is one question: what safeguards allow trust in an expert’s contribution to rest on concrete evidence rather than reputation alone?

Questions of public interest, not judgments about individuals

Methodological, professional, and organizational shortcomings can raise questions of public interest, including when they emerge through high-profile events. DF Integrity seeks to examine these questions in terms of principles, methods, and safeguards, without reconstructing or assessing the events that prompted the discussion. DF Integrity is not, and does not seek to become, an inquisitorial forum, a professional tribunal, or a vehicle for accusations or judgments about reputations. It does not investigate people, determine individual responsibility, or address the merits of judicial proceedings or professional disputes. Its analyses do not include names, references, or circumstances that could identify people, organizations, or individual cases, even when combined. The aim is not to recount a case with the names removed, but to formulate independent questions of general relevance and public interest.

Why Digital Forensics and Cybersecurity

The project studies digital forensic examinations alongside cybersecurity assessments and interventions: risk analysis, security assessments, incident management, and specialist activities that require a clearly defined mandate, documented procedures, and scrutiny of conclusions. It examines the connections among system protection, traceable activities, data preservation, and the interpretation of evidence. The two fields are considered where they intersect, without conflating their purposes or responsibilities. The safeguards relevant to a court-ordered expert examination, an expert engagement on behalf of a party, or a security intervention must be assessed in relation to the role, the assignment, and the operational context.

Areas of inquiry

Methodological rigor and verifiability

Qualifications relevant to the work performed, appropriate methods, checks on tools, and documentation of the analytical process. Particular attention is paid to distinguishing observed data, processing outputs, inferences, and hypotheses, and to explicitly stating uncertainty and the limits of conclusions. The objective is to understand the conditions under which work can be independently verified and the obstacles that must be disclosed.

Independence and transparency about interests

Examination of financial, professional, organizational, and media relationships that are materially relevant to an assignment, including relationships with clients, technology providers, and others involved in the assessments. The project studies criteria for making these relationships transparent and open to assessment, without presuming a conflict simply because a collaboration exists and without treating situations that differ in nature and significance as equivalent.

Independent technical debate

Study of the conditions that allow documented objections to be raised and discussed without prestige, visibility, or professional dependencies taking the place of debate on the merits. Criticism can be both respectful and incisive; agreement can result from rigorous verification. The point is to make the reasons for each clear, while distinguishing scientific disagreement from misconduct. Public recognition does not replace scrutiny of the work; professional qualifications do not exempt conclusions from review.

Traceability of cybersecurity interventions

Examination of authorizations, privileges, access logging, and documentation of operations performed on systems. This includes distinguishing those who design, supply, operate, and assess a security solution, with attention to the safeguards needed when these functions overlap. The study also addresses the conditions and limitations involved in reconstructing an event and attributing digital activity to a specific party.

Artificial intelligence and scrutiny of results

Examination of safeguards in the use of automated and artificial intelligence systems: fitness for the task, data provenance, documentation of processing, potential biases, tool limitations, and human verification. The project also considers the assessment of synthetic or altered content and transparency in relationships with providers. A tool’s output must be open to critical examination, rather than treated as a conclusion that stands on its own.

Error management and professional integrity

Study of ways to identify and document shortcomings, disclose significant errors, correct conclusions, and assess potential effects on other work, while respecting the professional role and applicable safeguards. This includes correctly attributing activities and contributions. The objective is to distinguish error, methodological weakness, reasoned disagreement, and misrepresentation of work without resorting to broad judgments about individuals.

Existing safeguards, fragmentation, and coordination

DF Integrity does not start from the assumption that rules or oversight are absent, but from the need to examine their coverage, coordination, and effectiveness together.

One central theme is how safeguards for methodological quality, professional independence, transparency about interests, and verifiability are distributed across Digital Forensics and Cybersecurity, including the use of artificial intelligence. The question is practical: who reviews what, under which powers, through which procedures, and with what avenues of protection for those affected? The involvement of multiple competent bodies is not inherently a weakness. A functional division of responsibilities must be distinguished from fragmentation that may impede oversight, coordination, or the identification of available remedies. The analysis therefore seeks to distinguish potential noncompliance, implementation difficulties, overlapping responsibilities, and documented gaps. These are different problems that may require different responses. On this basis, the project considers strengthening existing mechanisms, improving coordination among their respective functions, and introducing targeted safeguards for specific activities.

Establishing a new body is one option to examine, not a predetermined conclusion. The purpose is not to add another layer of oversight automatically, but to understand whether and where useful, proportionate, and practically sustainable measures are needed.

From the initial idea to potential institutional safeguards

The initial idea was a small, independent, interdisciplinary committee with an advisory role, focused on recommendations and general methodological questions. The discussion subsequently broadened from developing good practices alone to studying professional, organizational, and institutional safeguards, including cybersecurity and the use of artificial intelligence. The options under consideration include a public oversight function for the quality and integrity of clearly defined specialist activities, to be assessed through comparison with international models and with respect for existing responsibilities. An initial draft of possible legislation concerning digital forensic examinations has been prepared. This is research material only, not a bill that has been formally introduced, and it is subject to scientific and legal review. Any extension to specific cybersecurity activities requires a separate assessment. Any model should ensure the independence of those exercising oversight, the right to be heard and respond, confidentiality, and the ability to challenge decisions. It should not replace the court, undermine the right of defense, obstruct scientific disagreement, or turn a professional credential into an absolute guarantee.

Studying these options does not give DF Integrity any authority to exercise oversight, issue certifications, or impose sanctions.

Project status

DF Integrity is at a preliminary research stage. Establishment of the committee and the launch of institutional or legislative initiatives have been deferred. This decision is intended to preserve the general scope of the inquiry and avoid overlap with ongoing judicial proceedings and matters receiving media attention. The project is not accepting applications, reports of concerns, or requests for opinions on individual matters. It does not receive dossiers, court documents, confidential records, or materials concerning identifiable people or cases.

Any developments and documents intended for publication will be presented after the necessary checks, with their sources, assumptions, limitations, and the nature of the proposals clearly identified.

A civic initiative by Federica Bertoni.
Last updated: October 8, 2026.