Cybersecurity and Digital Forensics for Multimodal Transport Accident Investigation: A Governance, Risk and Compliance Framework

When a train derails, a plane crashes, or a ship collides with a dock, the search for answers has always relied on physical clues: twisted metal, broken rails, and the testimony of survivors. But over the last two decades, the way we move people and goods has changed fundamentally. Modern transport systems are no longer just machines; they are complex networks of software, sensors, and digital communications that talk to one another. A train's speed, a ship's course, or a truck's route is now managed by code. This shift means that when an accident happens, the most critical evidence often exists only as digital records—logs of what the computer saw, telemetry data from sensors, and messages sent between control centers. However, this digital reliance creates a new problem. Just as a physical scene can be contaminated by rain or footprints, digital evidence can be altered, deleted, or hidden by cyberattacks. If investigators cannot be sure that a digital record is genuine, or if they cannot legally access the right data quickly, the truth about what caused an accident may remain forever out of reach.

This uncertainty is the central challenge addressed by a new study from researchers at the Shobhit Institute of Engineering and Technology in India. The authors, Abidina Tijjani Kalarawi, Sadeeq Muhammad, and Mamta Bansal, argue that current accident investigations are not ready for this digital reality. In many cases, experts in cybersecurity and digital forensics are brought in too late, after the digital evidence has already been compromised or lost. Furthermore, the rules for who is allowed to access these sensitive systems are often unclear, leading to delays or legal disputes that stall the investigation. The researchers propose a new way of thinking about these inquiries, one that treats cybersecurity and digital forensics not as technical add-ons, but as core components of the investigation from the very first moment. They call this approach a Governance, Risk, and Compliance framework. In simple terms, this means establishing clear rules for who has the authority to act, constantly assessing the danger that the digital evidence itself might be fake or tampered with, and ensuring that every step taken follows the law so that the findings can be used in court.

To test whether this idea works in practice, the team did not wait for a real-world disaster to occur. Instead, they built a digital simulation to see how their new rules would handle a flood of requests for access to accident data. They created a scenario involving ten thousand hypothetical requests from investigators trying to view different parts of a transport system. Each request came with a set of conditions, such as the investigator's role, the time of day, the health of their computer, and whether they were accessing the system from a strange location. The simulation then applied the researchers' new framework to decide whether to grant or deny each request. The system acted like a series of security gates. First, it checked if the person asking had the proper job title and permission to see that specific data. If they passed that, the system checked if the request violated any legal rules about preserving evidence. Finally, it calculated a risk score based on the context of the request. If a request came from a device that seemed unhealthy or from a location that didn't match the investigator's usual pattern, the system would flag it for extra verification or deny it entirely.

The results of this simulation showed that the framework creates a clear, defensible path for handling digital evidence. Out of the ten thousand requests, about 53 percent were allowed to proceed immediately. Roughly 39 percent were denied because the person asking did not have the right authority to see that data. A small but significant portion, about 4 percent, were challenged to prove their identity with a second factor, such as a code sent to a phone, because the system detected a medium level of risk. Another 3 percent were blocked because the system's risk calculation suggested something unusual was happening, and the final 1 percent were denied because the request tried to change or delete evidence, which is strictly forbidden. These numbers are not a prediction of how many accidents will happen, but rather a demonstration that the proposed rules can sort through thousands of complex situations quickly and consistently. The simulation proved that it is possible to balance the need for investigators to see data with the need to protect that data from tampering or unauthorized access.

The study also highlights a crucial shift in how we understand the causes of transport accidents. In the past, investigators might assume a failure was due to a broken part or a human mistake. This new framework insists that investigators must also consider the possibility that a computer was hacked or that data was manipulated before the accident occurred. By integrating these questions into the standard investigation process, the framework ensures that the possibility of a cyberattack is never overlooked. It provides a structured way to preserve volatile data—information that disappears quickly, like the contents of a computer's memory—before it is lost. It also clarifies the roles of different experts, ensuring that a cybersecurity specialist works alongside the engineers and legal advisors from day one, rather than being called in as an afterthought.

While the study offers a promising blueprint, the authors are careful to note that this is a conceptual model tested in a controlled environment, not a finished product ready for immediate use in every country. The rules and numbers used in the simulation were designed to show how the system works, not to claim that they are the perfect settings for every real-world situation. Different transport systems, laws, and organizations will need to adapt these rules to fit their specific needs. The researchers acknowledge that for this framework to succeed, transport companies and governments must be willing to share data, update their logging systems, and agree on common standards for evidence handling. Without these real-world changes, even the best framework cannot function.

Ultimately, this work points toward a future where the investigation of transport accidents is as sophisticated as the systems that cause them. As our roads, rails, and skies become more connected, the tools we use to find the truth must evolve to match that complexity. By treating digital evidence with the same care and rigor as physical wreckage, and by establishing clear rules for how that evidence is handled, investigators can ensure that the answers they find are accurate, reliable, and legally sound. The goal is not just to solve the mystery of what went wrong, but to do so in a way that restores confidence in the safety of the systems we rely on every day.