Ethics, Privacy

1
Ethics, Privacy Computer Forensics

• Chapter 2 History Terminology of Computer
  Crime Investigation

2
Some History

• Earliest recorded computer crime in 1969 and 1970
  where a student burnt computers of universities
• 1978 after a publicized case after employees of a
  track game used computers to print fraudulently
  winning tickets
• Florida Computer Crimes Act came about
• All unauthorized access to a computer is a crime
  if unintentional
• Other states adopted except Vermont
• Canada was the first country to enact a federal
  law to address computer crimes in amending their
  criminal code in 1988
• Australian Crimes Act was amended in 1989

3
Some History

• This lead to expedited training programs at the
  US federal level
• Rapid development
• Pyramid structure
• Responders collecting evidence
• Examination handle rest of case
• Regional support and Federal support with more
  complex cases

4
Evolution of investigative Tools

• Early cases used the computer itself to obtain
  and analyze evidence
• May tamper with evidence unintentionally
• Never looked at deleted data rather worked with
  the file system
• UNIX provided primitive utilities like dd to
  recover deleted files
• 1990s tools like SafeBack and DIBS were developed
  to enable investigators to collect data with
  altering important information
• IRS, RCMP, also developed tools
• Encase and others have developed better tools

5
Evolution of investigative Tools

• 1980s network monitoring tools like tcpdump
  etherreal used to monitor and capture traffic
• Today plenty of network capturing tools
• Vontu, Vericept and Reconnex are just few
• Carnivore, Netintercept, NFR Security etc
• As bugs are discovered in these tools entailing
  missed evidence
• NIST is making effort to test tools before they
  can sort of certify them to use
  (www.cftt.nist.gov )

6
Language of Computer Crime Investigation

• Lack of standards and agreement on terminology
• No internationally recognized definitions
• But the general definition accepted is that
  computer crimes (Cybercrimes) are crimes
  committed by individuals that include
• Computer theft
• Piracy and alteration of data
• Unauthorized access
• Extortion committed with the assistance of
  computers
• Stolen password via sniffing traffic
• Intrusion of viruses and other malicious codes
• The list is growing

7
Language of Computer Crime Investigation

• The role of a computer in a crime will dictate
  the type of analysis required
• In a criminal case, investigators may not need or
  do not require to analyze an entire computer
• When a computer is used as part of the evidence
  then investigators will analyze the entire
  computer

8
Language of Computer Crime Investigation Donn
Parker Proposed Definitions

• Computer can be used as
• The object of a crime targeting the computer
  like unauthorized access
• Subject of a crime for a crime like installing
  agent to attack others
• Tool for conducting or planning a crime in
  order to forge documents
• Symbol for intimidating by referring to a
  computer that for example has huge properties to
  predict the future

9
Language of Computer Crime Investigation

• Definitions
• Target object of an attack from offenders
  standpoint
• Intended victim person, group or institution
  that would suffer loss or harm
• Collateral victim other victims that maybe in
  the middle and were not originally targeted
• Collateral victims in Iraq

10
Language of Computer Crime Investigation

• In 1994 the USDoJ crated a set of categories for
  an associated search and seizure
• Useful when developing procedures and from a
  probative stand point
• Categories that fall under digital evidence
• Hardware as contraband or fruits of crime
• Hardware as an instrumentality
• Hardware as evidence
• Information as contraband of fruits of crime
• Information as instrumentality
• Information as evidence
• These are not mutually exclusive
• Later on the USDoJ gave more importance to the
  data stored and communicated

11
Language of Computer Crime Investigation
Hardware/Information

• Contraband - property that the private citizen
  is not permitted to process
• Equipment that intercept traffic
• (Phenomena the movie)
• Cloned cellular phones
• Encryption Software
• Fruit of crime include property that was obtained
  by criminal activity such as a stolen computer
• Instrumentality
• If a computer is used as a weapon like a gun or a
  knife sniffers if used improperly are such
  instruments
• Computer exploits and Keyboard loggers
• Used as evidence like a computer used to
  digitize child pornography

12
Homework/Case Study

• Pg 114 liser vs. smith (2003)
• www.dcd.uscourts.gov/Opinions/2003/Huvelle/00-2325
  .pdf
• Analyze the case
• Point to the digital evidence used in the case