Ethics, Privacy and Computer Forensics

1
Ethics, Privacy and Computer Forensics

• Chap 6 Modus Operendi Technology

2
Intro

• Advance Research Projects Agency (ARPA) invented
  the internet in 1969
• To assist in internal military communication
• It was not their intention to put it in the hands
  of criminals
• Modus Operandi mode of operation
• Reflects how a crime was committed
• Amount of planning
• Pre-surveillance of a crime scene
• Offense location selection
• Use of weapons or commputer tools
• Risk taking measures

3
Technology

• Postal system
• Used to sell non existent properties to elderly
• Telephone
• Networking of criminals
• Fax machines
• Criminal networking
• Email
• Harassment and phising
• Web sites
• Phising
• Criminal praying
• Child pornography

4
Motive Technology

• Motive refers to emotional or psychological or
  material need that impels and is satisfied by a
  behavior.
• Criminal motive is generally technology
  independent
• Must understand the psychological basis for
  criminal behavior

5
Motive Technology

• Power reassurance
• Intended to restore self confidence via low
  aggression means
• Stalking and harassment
• Power assertive
• Intended to restore self confidence and self
  worth with medium to high aggression
• Sabotage and stalking
• Anger retaliatory
• Rage towards group, person, institution or a
  symbol of either
• Sexual assults, domestic homicides, work related
  homicide, harassment, and terrorist activities
• Sadistic
• Sexual gratification from victim suffering and
  pain
• Murders with sadistic implications
• Profit oriented
• Material of personal gain

6
Ethics, Privacy and Computer Forensics

• Chap 7 Digital Evidence in Courtroom

7
Intro

• When processing digital evidence there are
  certain requirements that need to be met
• Not tampered with and authentic
• US Rules of Evidence
• UK Police and Criminal Evidence Act
• Civil Evidence Act
• Chain of custody
• WHO HANDLED THE EVIDENCE AND WHEN

8
Admissibility - Warrants

• Common mistake for evidence not accepted in court
  is being obtained w/out authorization
• Only in emergencies can a search be accepted
  w/out authorization
• When searching for Digital Evidence
• Does any privacy law apply limitations
  validity
• Does the 4th amendment apply (protecting against
  unreasonable search and seizure)
• How long can investigators remain at the scene
• What do investigators need to re-enter

9
Admissibility - Warrants

• Searching a computer
• Must maintain focus and objective
• Focus on the scope of the investigation
• If another crime discovered, secure another
  search and seizure
• Proper handling is extremely important for
  admissibility in a court

10
Authenticity Reliability

• 2 step process
• Initial examination of evidence to determine that
  it supports a claim
• System Admin can testify that the logs are coming
  from a UNIX machine that they are responsible for
• Analysis to determine how adequate the evidence
  is to support or prove a case

11
Caseys Certainty Scale

• Computers and humans can introduce errors and
  uncertainty
• Computer networks complicate reliability
  considerations because of multiple systems and
  processes involved
• We need a consistent method of referring to the
  relative certainty of different types of digital
  evidence
• Table 7.1 pg 176
• If suspicion that evidence was tampered with, the
  C-value will drop

12
Evidence Quality

• Best evidence is the original evidence intact
• Direct evidence establishes facts
• Circumstantial evidence may suggest one fact
• Digital evidence can be used to prove facts
• If an account is used by multiple people but we
  can prove that the only person present at
  location X at the time was Person B

13
Hearsay

• Not covering 7.6-7.8
• Evidence based on what the witness has heard
  someone else say, rather than what he/she has
  personally experienced.www.sedgwickcounty.org/da/
  legal_terms.html

14
Homework

• Brief introduction to the following not more
  than ½ a page typed in word document
• US Rules of Evidence
• http//www.law.cornell.edu/rules/fre/
• UK Police and Criminal Evidence Act
• http//www.swarb.co.uk/acts/1984PoliceandCriminalE
  videnceAct.shtml
• Civil Evidence Act
• http//www.swarb.co.uk/acts/1995Civil_EvidenceAct.
  shtml