Computer Law Commons^™

Forensic Cell Site Analysis: A Validation & Error Mitigation Methodology, John B. Minor

Journal of Digital Forensics, Security and Law

The E911 Initiative in the mid-1990s established an opportunity to obtain location specific digital evidence of subscriber activity from cellular carriers. Call Detail Records (CDR) containing Cell Site Location Information (CSLI) evidence production was made available from cellular carriers in response to the CALEA, 911 and ECPA acts. In the late 1990s, cellular carriers began to produce evidence for investigative and litigation purposes. CDR/CSLI evidence has become an important evidentiary focus in the courtroom. This research project resulted in the creation of a method of validating cellular carrier records accuracy and mitigating errors in forensic cell site analyst conclusions. The …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

File Type Identification - Computational Intelligence For Digital Forensics, Konstantinos Karampidis, Giorgos Papadourakis

Journal of Digital Forensics, Security and Law

In modern world, the use of digital devices for leisure or professional reasons is growing quickly; nevertheless, criminals try to fool authorities and hide evidence in a computer by changing the file type. File type detection is a very demanding task for a digital forensic examiner. In this paper, a new methodology is proposed – in a digital forensics perspective- to identify altered file types with high accuracy by employing computational intelligence techniques. The proposed methodology is applied to the three most common image file types (jpg, png and gif) as well as to uncompressed tiff images. A three-stage process …

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Signatures Of Viber Security Traffic, M.A.K. Sudozai, N. Habib, S. Saleem, A.A. Khan

Journal of Digital Forensics, Security and Law

Viber is one of the widely used mobile chat application which has over 606 million users on its platform. Since the recent release of Viber 6.0 in March/April 2016 and its further updates, Viber provides end-to-end encryption based on Open Whisper Signal security architecture. With proprietary communication protocol scattered on distributed cluster of servers in different countries and secure cryptographic primitives, Viber offers a difficult paradigm of traffic analysis. In this paper, we present a novel methodology of identification of Viber traffic over the network and established a model which can classify its services of audio and audio/video calls, message …

Applying A Contingency Framework To Digital Forensic Processes In Cloud Based Acquisitions, Diane Barrett

Journal of Digital Forensics, Security and Law

The change in business models to incorporate a wide variety of cloud computing environments has resulted in the escalation of computer crimes in the areas of security breaches and hacking. Methods to acquire evidence in a cloud computing environment are limited due to the complexity of the cloud environment. Since digital acquisition processes in cloud computing environments are still in the infancy stages, there have been no studies in the application of existing frameworks to this type environment based on traditional forensic processes.

This paper describes a qualitative study conducted to develop a robust contingency framework for deciding when to …

Protecting Digital Evidence Integrity And Preserving Chain Of Custody, Makhdoom Syed Muhammad Baqir Shah, Shahzad Saleem, Roha Zulqarnain

Journal of Digital Forensics, Security and Law

Evidence is the key to solve any crime. Evidence integrity needs to be protected in order to make it admissible in the court of law. Digital evidence is more revealing, but it is fragile; it can easily be tampered with or modified. There are different techniques available to protect the integrity of digital evidence. Different automated digital evidence acquisition tools are available in the market. In this paper, we have analyzed two automated tools (EnCase and FTK Imager) that are used for disk imaging. These tools claim to protect the integrity of digital evidence. The techniques used by these tools …

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Send Us The Bitcoin Or Patients Will Die: Addressing The Risks Of Ransomware Attacks On Hospitals, Deborah R. Farringer

Seattle University Law Review

Part I of this Article describes how the healthcare industry has arrived in this place of vulnerability, including (1) the history of the movement toward EHRs through HIPAA, (2) HIPAA’s meaningful use regulations and the background of current ransomware attacks, and (3) the distinctions between these attacks and other security breaches that have plagued large insurers and health systems within the last five years. Next, Part II will examine current industry culture when it comes to cybersecurity and review current legal and business approaches to address this growing threat. Then, Part III will argue that, while the current laws—including HIPAA …

Employer Liability And Bring Your Own Device: Do Existing Regulations Support Employer Liability For A Compromised Personal Device?, Beth A. Hutchens

Technology Law and Public Policy Clinic

As employers increasingly permit employees to use their personal devices (known as Bring Your Own Device, or “BYOD”) for business purposes, and as the risk of data exposure continues to rise, the question of how, when, and against whom to attach liability remains in flux. This paper will endeavor to explore employer liability as viewed through the lens of hacked or compromised BYOD devices. The research begins by identifying BYOD as a concept along with the risks and benefits incident to the practice. It then discusses current state and federal data protection regulations. It then explores recurring themes in data …

Sony, Cyber Security, And Free Speech: Preserving The First Amendment In The Modern World, Conrad Wilton

Pace Intellectual Property, Sports & Entertainment Law Forum

Reprinted from 16 U.C. Davis Bus. L.J. 309 (2016). This paper explores the Sony hack in 2014 allegedly launched by the North Korean government in retaliation over Sony’s production of The Interview and considers the hack’s chilling impact on speech in technology. One of the most devastating cyber attacks in history, the hack exposed approximately thirty- eight million files of sensitive data, including over 170,000 employee emails, thousands of employee social security numbers and unreleased footage of upcoming movies. The hack caused Sony to censor the film and prompted members of the entertainment industry at large to tailor their communication …

The Inadequate, Invaluable Fair Information Practices, Woodrow Hartzog

Maryland Law Review

No abstract provided.

Interpretation Catalysts In Cyberspace, Rebecca Ingber

Faculty Scholarship

The cybersphere offers a rich space from which to explore the development of international law in a compressed time frame. This piece examines the soft law process over the last decade of the two Tallinn Manuals – handbooks on the international law of cyber warfare and cyber operations – as a valuable lens through which to witness the effects of “interpretation catalysts” on the evolution of international law. In prior work, I identified the concept of interpretation catalysts – discrete triggers for legal interpretation – and their influence on the path that legal evolution takes, including by compelling a decision-making …

Did Russian Cyber Interference In The 2016 Election Violate International Law?, Jens David Ohlin

Cornell Law Faculty Publications

When it was revealed that the Russian government interfered in the 2016 U.S. presidential election by hacking into the email system of the Democratic National Committee and releasing its emails, international lawyers were divided over whether the cyber-attack violated international law. President Obama seemingly went out of his way to describe the attack as a mere violation of “established international norms of behavior,” though some international lawyers were more willing to describe the cyber-attack as a violation of international law. However, identifying the exact legal norm that was contravened turns out to be harder than it might otherwise appear. To …

Algorithmic Discrimination White Paper, Vicky Wei, Teresa Stephenson

Technology Law and Public Policy Clinic

Technological innovation has led to the prevalent use of algorithms in everyday decision making. So ubiquitous is the application of algorithms that many may not recognize its impact on their daily lives. From online shopping to applying for a home loan, algorithms are at play in categorizing and filtering individuals to serve the goal of providing more accurate and efficient results than human decisionmaking would. At the basic level, algorithms are nothing more than a series of step-by-step instructions compiled by a computer, which then analyzes swaths of data based on those instructions. However, when algorithms use incorrect variables to …

Exploring Digital Evidence With Graph Theory, Imani Palmer, Boris Gelfand, Roy Campbell

Annual ADFSL Conference on Digital Forensics, Security and Law

The analysis phase of the digital forensic process is the most complex. The analysis phase remains very subjective to the views of the forensic practitioner. There are many tools dedicated to assisting the investigator during the analysis process. However, they do not address the challenges. Digital forensics is in need of a consistent approach to procure the most judicious conclusions from the digital evidence. The objective of this paper is to discuss the ability of graph theory, a study of related mathematical structures, to aid in the analysis phase of the digital forensic process. We develop a graph-based representation of …

Case Study: A New Method For Investigating Crimes Against Children, Hallstein Asheim Hansen, Stig Andersen, Stefan Axelsson, Svein Hopland

Annual ADFSL Conference on Digital Forensics, Security and Law

Investigations of crimes against children are often complex, both in terms of the varied and large amount of digital technology encountered and the offensive nature of the crimes. Such cases are numerous, large, and prioritised, requiring digital forensics competence. Earlier digital forensics was considered and treated as a typical forensic science like fingerprint analysis, performed in a laboratory isolated from the investigative team. This decoupled way of working has proved to be both inefficient and error prone.

At the Digital Forensic Unit of Oslo Police District we have developed a new way of working that addresses many of the problems …

Downstream Competence Challenges And Legal/Ethical Risks In Digital Forensics, Michael M. Losavio, Antonio Losavio

Annual ADFSL Conference on Digital Forensics, Security and Law

Forensic practice is an inherently human-mediated system, from processing and collection of evidence to presentation and judgment. This requires attention to human factors and risks which can lead to incorrect judgments and unjust punishments.

For digital forensics, such challenges are magnified by the relative newness of the discipline and the use of electronic evidence in forensic proceedings. Traditional legal protections, rules of procedure and ethics rules mitigate these challenges. Application of those traditions better ensures forensic findings are reliable. This has significant consequences where findings may impact a person's liberty or property, a person's life or even the political direction …

Understanding Deleted File Decay On Removable Media Using Differential Analysis, James H. Jones Jr, Anurag Srivastava, Josh Mosier, Connor Anderson, Seth Buenafe

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital content created by picture recording devices is often stored internally on the source device, on either embedded or removable media. Such storage media is typically limited in capacity and meant primarily for interim storage of the most recent image files, and these devices are frequently configured to delete older files as necessary to make room for new files. When investigations involve such devices and media, it is sometimes these older deleted files that would be of interest. It is an established fact that deleted file content may persist in part or in its entirety after deletion, and identifying the …

Development Of A Professional Code Of Ethics In Digital Forensics, Kathryn C. Seigfried-Spellar, Marcus Rogers, Danielle M. Crimmins 2184089

Annual ADFSL Conference on Digital Forensics, Security and Law

Academics, government officials, and practitioners suggest the field of digital forensics is in need of a professional code of ethics. In response to this need, the authors developed and proposed a professional code of ethics in digital forensics. The current paper will discuss the process of developing the professional code of ethics, which included four sets of revisions based on feedback and suggestions provided by members of the digital forensic community. The final version of the Professional Code of Ethics in Digital Forensics includes eight statements, and we hope this is a step toward unifying the field of digital forensics …

Defining A Cyber Jurisprudence, Peter R. Stephenson Phd

Annual ADFSL Conference on Digital Forensics, Security and Law

Jurisprudence is the science and philosophy or theory of the law. Cyber law is a very new concept and has had, compared with other, older, branches of the law, little structured study. However, we have entered the cyber age and the law - on all fronts - is struggling to keep pace with technological advances in cyberspace. This research explores a possible theory and philosophy of cyber law, and, indeed, whether it is feasible to develop and interpret a body of law that addresses current and emerging challenges in cyber space.

While there is an expanding discussion of the nature …

Harnessing Predictive Models For Assisting Network Forensic Investigations Of Dns Tunnels, Irvin Homem, Panagiotis Papapetrou

Annual ADFSL Conference on Digital Forensics, Security and Law

In recent times, DNS tunneling techniques have been used for malicious purposes, however network security mechanisms struggle to detect them. Network forensic analysis has been proven effective, but is slow and effort intensive as Network Forensics Analysis Tools struggle to deal with undocumented or new network tunneling techniques. In this paper, we present a machine learning approach, based on feature subsets of network traffic evidence, to aid forensic analysis through automating the inference of protocols carried within DNS tunneling techniques. We explore four network protocols, namely, HTTP, HTTPS, FTP, and POP3. Three features are extracted from the DNS tunneled traffic: …

Ispy: Threats To Individual And Institutional Privacy In The Digital World, Lori Andrews

All Faculty Scholarship

What type of information is collected, who is viewing it, and what law librarians can do to protect their patrons and institutions.

Towards An Effective Regime Against Online Copyright Infringement In India, Ashwin Ramakrishnan

LLM Theses

With Internet usage on the rise, it is important for India to establish an effective regulatory regime to combat piracy and mass copyright infringement online. This thesis argues that, in the face of unique legal and cultural challenges specific to India, present laws in the country have failed to do so. Unless and until these challenges are met it will be difficult to have an effective mechanism that deals with online copyright infringement. Countries like the United States, Canada, Ireland, and France have all adopted different regulatory models. However, this thesis argues that each not only have significant limitations on …

Internet Tv: (Hopefully) Coming To A Computer Screen Near You, Nicholas Pellegrino

Seton Hall Circuit Review

No abstract provided.

The Racist Algorithm?, Anupam Chander

Michigan Law Review

Review of The Black Box Society: The Secret Algorithms That Control Money and Information by Frank Pasquale.

Special Issue Of Best Papers From The 11th International Conference On Systematic Approaches To Digital Forensic Engineering (Sadfe 2016)

Journal of Digital Forensics, Security and Law

The SADFE series feature the different editions of the International Conference on Systematic Approaches to Digital Forensics Engineering. Now in its eleventh edition, SADFE has established itself as the premier conference for researchers and practitioners working in Systematic Approaches to Digital Forensics Engineering.

SADFE 2016, the eleventh international conference on Systematic Approaches to Digital Forensic Engineering was held in Kyoto, Japan, September 20 - 22, 2016.

Digital forensics engineering and the curation of digital collections in cultural institutions face pressing and overlapping challenges related to provenance, chain of custody, authenticity, integrity, and identity. The generation, analysis and sustainability of digital …

Compression Of Virtual-Machine Memory In Dynamic Malware Analysis, James E. Fowler Ph.D.

Journal of Digital Forensics, Security and Law

Lossless compression of memory dumps from virtual machines that run malware samples is considered with the goal of significantly reducing archival costs in dynamic-malware-analysis applications. Given that, in such dynamic-analysis scenarios, malware samples are typically run in virtual machines just long enough to activate any self-decryption or other detection- avoidance maneuvers, the virtual-machine memory typically changes little from that of the baseline state, with the difference being attributable in large degree to the loading of additional executables and libraries. Consequently, delta coding is proposed to compress the current virtual-machine memory dump by coding its differences with respect to a predicted …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Find Me If You Can: Mobile Gps Mapping Applications Forensic Analysis & Snavp The Open Source, Modular, Extensible Parser, Jason Moore, Ibrahim Baggili, Frank Breitinger

Journal of Digital Forensics, Security and Law

The use of smartphones as navigation devices has become more prevalent. The ubiquity of hand-held navigation devices such as Garmins or Toms Toms has been falling whereas the ownership of smartphones and their adoption as GPS devices is growing. This work provides a comprehensive study of the most popular smartphone mapping applications, namely Google Maps, Apple Maps, Waze, MapQuest, Bing, and Scout, on both Android and iOS. It details what data was found, where it was found, and how it was acquired for each application. Based on the findings, the work allowed for the construction of a tool capable of …