National Security Law Commons^™

Botnet Forensic Investigation Techniques And Cost Evaluation, Brian Cusack

Annual ADFSL Conference on Digital Forensics, Security and Law

Botnets are responsible for a large percentage of damages and criminal activity on the Internet. They have shifted attacks from push activities to pull techniques for the distribution of malwares and continue to provide economic advantages to the exploiters at the expense of other legitimate Internet service users. In our research we asked; what is the cost of the procedural steps for forensically investigating a Botnet attack? The research method applies investigation guidelines provided by other researchers and evaluates these guidelines in terms of the cost to a digital forensic investigator. We conclude that investigation of Botnet attacks is both …

Development And Dissemination Of A New Multidisciplinary Undergraduate Curriculum In Digital Forensics, Masooda Bashir, Jenny A. Applequist, Roy H. Campbell, Lizanne Destefano, Gabriela L. Garcia, Anthony Lang

Annual ADFSL Conference on Digital Forensics, Security and Law

The Information Trust Institute (ITI) at the University of Illinois at Urbana-Champaign is developing an entirely new multidisciplinary undergraduate curriculum on the topic of digital forensics, and this paper presents the findings of the development process, including initial results and evaluation of a pilot offering of the coursework to students. The curriculum consists of a four-course sequence, including introductory and advanced lecture courses with parallel laboratory courses, followed by an advanced course. The content has been designed to reflect both the emerging national standards and the strong multidisciplinary character of the profession of digital forensics, and includes modules developed collaboratively …

Computer Forensics For Accountants, Grover S. Kearns

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital attacks on organizations are becoming more common and more sophisticated. Firms are interested in providing data security and having an effective means to respond to attacks. Accountants possess important investigative and analytical skills that serve to uncover fraud in forensic investigations. Some accounting students take courses in forensic accounting but few colleges offer a course in computer forensics for accountants. Educators wishing to develop such a course may find developing the curriculum daunting. A major element of such a course is the use of forensic software. This paper argues the importance of computer forensics to accounting students and offers …

Applying Memory Forensics To Rootkit Detection, Igor Korkin, Ivan Nesterov

Annual ADFSL Conference on Digital Forensics, Security and Law

Volatile memory dump and its analysis is an essential part of digital forensics. Among a number of various software and hardware approaches for memory dumping there are authors who point out that some of these approaches are not resilient to various anti-forensic techniques, and others that require a reboot or are highly platform dependent. New resilient tools have certain disadvantages such as low speed or vulnerability to rootkits which directly manipulate kernel structures, e.g., page tables. A new memory forensic system – Malware Analysis System for Hidden Knotty Anomalies (MASHKA) is described in this paper. It is resilient to popular …

The Federal Rules Of Civil Procedure: Politics In The 2013-2014 Revision, John W. Bagby, Byron Granda, Emily Benoit, Alexander Logan, Ryan Snell, Joseph J. Schwerha

Annual ADFSL Conference on Digital Forensics, Security and Law

Pre-trial discovery is perpetually controversial. Parties advantaged by strict privacy can often avoid justice when this is disadvantageous to their interests. Contrawise, parties advantaged by relaxed litigation privacy can achieve justice when all facts are accessible irrespective of their repositories, ownership or control. American-style pre-trial discovery in civil and regulatory enforcement is relatively rare around the world. U.S. discovery rules open nearly all relevant and non-privileged data for use by opposing parties. The traditional discovery process was costly and time consuming in the world of tangible paper data. However, these burdens have increased, rather than diminished as often predicted, as …

Testing And Evaluating The Harmonised Digital Forensic Investigation Process In Post Mortem Digital Investigation, Emilio R. Mumba, H. S. Venter

Annual ADFSL Conference on Digital Forensics, Security and Law

Existing digital forensic investigation process models have provided guidelines for identifying and preserving potential digital evidence captured from a crime scene. However, for any of the digital forensic investigation process models developed across the world to be adopted and fully applied by the scientific community, it has to be tested. For this reason, the Harmonized Digital Forensic Investigation Process (HDFIP) model, currently a working draft towards becoming an international standard for digital forensic investigations (ISO/IEC 27043), needs to be tested.

This paper, therefore, presents the findings of a case study used to test the HDFIP model implemented in the ISO/IEC …

Generation And Handling Of Hard Drive Duplicates As Piece Of Evidence, T. Kemmerich, F. Junge, N. Kuntze, C. Rudolph, B. Endicott-Popovsky, L. Großkopf

Annual ADFSL Conference on Digital Forensics, Security and Law

An important area in digital forensics is images of hard disks. The correct production of the images as well as the integrity and authenticity of each hard disk image is essential for the probative force of the image to be used at court. Integrity and authenticity are under suspicion as digital evidence is stored and used by software based systems. Modifications to digital objects are hard or even impossible to track and can occur even accidentally. Even worse, vulnerabilities occur for all current computing systems. Therefore, it is difficult to guarantee a secure environment for forensic investigations. But intended deletions …

Internet Addiction To Child Pornography, Rachel Sitarz, Marcus Rogers, Lonnie Bentley, Eugene Jackson

Annual ADFSL Conference on Digital Forensics, Security and Law

During the present age and time, it seems as though people in society have become addicted to nearly anything and everything, whether it be to a substance, an activity or an object. The Internet and pornography is no exception. While commonly thought of as a deviant behavior, many are displaying addictions towards the Internet and pornography. More alarming, however, are those who are viewing, downloading, or trading child pornography and displaying addictive Internet behaviors, for they are spending excessive amounts of time engaging in the proliferation of child pornographic materials. For this reason, addiction to the Internet and usage of …

Using Internet Artifacts To Profile A Child Pornography Suspect, Marcus K. Rogers, Kathryn C. Seigfried-Spellar

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital evidence plays a crucial role in child pornography investigations. However, in the following case study, the authors argue that the behavioral analysis or “profiling” of digital evidence can also play a vital role in child pornography investigations. The following case study assessed the Internet Browsing History (Internet Explorer Bookmarks, Mozilla Bookmarks, and Mozilla History) from a suspected child pornography user’s computer. The suspect in this case claimed to be conducting an ad hoc law enforcement investigation. After the URLs were classified (Neutral; Adult Porn; Child Porn; Adult Dating sites; Pictures from Social Networking Profiles; Chat Sessions; Bestiality; Data Cleaning; …

Life (Logical Iosforensics Examiner): An Open Source Iosbackup Forensics Examination Tool, Ibrahim Baggili, Shadi Al Awawdeh, Jason Moore

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper, we present LiFE (Logical iOS Forensics Examiner), an open source iOS backup forensics examination tool. This tool helps both researchers and practitioners alike in both understanding the backup structures of iOS devices and forensically examining iOS backups. The tool is currently capable of parsing device information, call history, voice messages, GPS locations, conversations, notes, images, address books, calendar entries, SMS messages, Aux locations, facebook data and e-mails. The tool consists of both a manual interface (where the user is able to manually examine the backup structures) and an automated examination interface (where the tool pulls out evidence …

Why Penetration Testing Is A Limited Use Choice For Sound Cyber Security Practice, Craig Valli, Andrew Woodward, Peter Hannay, Mike Johnstone

Annual ADFSL Conference on Digital Forensics, Security and Law

Penetration testing of networks is a process that is overused when demonstrating or evaluating the cyber security posture of an organisation. Most penetration testing is not aligned with the actual intent of the testing, but rather is driven by a management directive of wanting to be seen to be addressing the issue of cyber security. The use of penetration testing is commonly a reaction to an adverse audit outcome or as a result of being penetrated in the first place. Penetration testing used in this fashion delivers little or no value to the organisation being tested for a number of …

Awareness Of Scam E-Mails: An Exploratory Research Study, Tejashree D. Datar, Kelly A. Cole, Marcus K. Rogers

Annual ADFSL Conference on Digital Forensics, Security and Law

The goal of this research was to find the factors that influence a user’s ability to identify e-mail scams. It also aimed to understand user’s awareness regarding e-mail scams and actions that need to be taken if and when victimized. This study was conducted on a university campus with 163 participants. This study presented the participants with two scam e-mails and two legitimate e-mails and asked the participants to correctly identify these e-mails as scam or legitimate. The study focused on the ability of people to differentiate between scam and legitimate e-mails. The study attempted to determine factors that influence …

Military Commissions In America? Domestic Liberty Implications Of The Military Commissions Act Of 2006, Sean Riordan

Touro Law Review

No abstract provided.

Abstention, Balancing The Equities, And Armed Conflict In Al-Nashiri: A Reply To Steve Vladeck And Kevin Jon Heller, Peter Margulies

Law Faculty Scholarship

No abstract provided.

Al-Nashiri, The Cole Bombing, And The Start Of The Conflict With Al-Qaeda, Peter Margulies

Law Faculty Scholarship

No abstract provided.

Obama Doesn’T Deserve Deference On Drone Deaths, Lauren Carasik

Media Presence

No abstract provided.

A Liberal Communitarian Approach To Security Limitations On The Freedom Of The Press, Amitai Etzioni

William & Mary Bill of Rights Journal

No abstract provided.

The Federal Witness Protection Program Revisited And Compared: Reshaping An Old Weapon To Meet New Challenges In The Global Crime Fighting Effort, Raneta Lawson Mack

University of Miami International and Comparative Law Review

No abstract provided.

Requiring A Nexus To National Security: Immigration, “Terrorist Activities,” And Statutory Reform, Jared Hatch

BYU Law Review

No abstract provided.

Yale Symposium: Unpacking Nsa's Global Problem, Peter Margulies

Law Faculty Scholarship

No abstract provided.

Circumventing The Constitution For National Security: An Analysis Of The Evolution Of The Foreign Intelligence Exception To The Fourth Amendment’S Warrant Requirement, Sarah Fowler

University of Miami National Security & Armed Conflict Law Review

Though few are even aware of its existence, the foreign intelligence exception to the Fourth Amendment’s warrant requirement affects the lives of nearly every American. Recent leaks of top-­‐secret National Security Administration documents depict how the government has morphed the exception into a massive catch all that allows intelligence agencies to perform invasive searches without a warrant and in complete disregard of the Constitution. The foreign intelligence exception began as a narrow tool to shield sensitive national security investigations, but its application has reached an alarming breadth.

This note explores the creation and expansion of the foreign intelligence exception, tracing …

The National Security Implications And Potential Solutions For The Unintended Consequences Of The 1980 Bayh-­‐Dole Act On Brain-­‐Injured Veterans From The Wars In Iraq And Afghanistan, Colonel Noel Christian Pace

University of Miami National Security & Armed Conflict Law Review

Traumatic brain injury (TBI) is the “signature wound” seen in veterans from the wars in Iraq and Afghanistan, from which the U.S. now has over 20,000 young veterans living with TBI. However, some unintended consequences of the Bayh-­‐Dole Act of 1980, a law designed to tap the “secret weapon” of federally funded research & development (R&D) to help the U.S. return to competitiveness after the recession of the late 1970’s, are now preventing these heroes from getting the treatment and cures they need. This article reviews the history of American academia’s close cooperation with the U.S. government in solving military …

Don’T Let Slip The Dogs Of War: An Argument For Reclassifying Military Working Dogs As “Canine Members Of The Armed Forces”, Michael J. Kranzler

University of Miami National Security & Armed Conflict Law Review

No abstract provided.

A Regime In Need Of Balance: The Un Counter-­Terrorism Regimes Of Security And Human Rights, Isaac Kfir

University of Miami National Security & Armed Conflict Law Review

Since 9/11, the UN’s counter-­‐terrorism regime has developed two distinct approaches to combating international terrorism. The Security Council follows a traditional security doctrine that focuses on how to best protect states from the threat posed by international terrorists. This is largely due to the centrality of the state in Security Council thinking and attitudes. On the other hand, the General Assembly and the various UN human rights organs, influenced by the human security doctrine, have taken a more holistic, human rights-­‐based approach to the threat of international terrorism. This paper offers a review of how the dichotomy above affects the …

Drones At Home: Domestic Drone Legislation -- A Survey, Analysis And Framework, Colonel Dawn M.K. Zoldi

University of Miami National Security & Armed Conflict Law Review

Can the government employ drones domestically without running roughshod over personal privacy? In an effort to preemptively rein in potential government overreach, most states have proposed legislation that restricts or forbids government drone use. The intent is to prevent drone use for warrantless information and evidence collection. Ironically, many of these proposals will have the opposite affect intended. State-­‐by-­‐state drone legislation may lead to consequences such as the erosion of Fourth Amendment jurisprudential principles, losses of life and property, procedural windfalls to criminals, and deleterious effects on the military.

Lawmakers should take a nuanced approach to government drone use rather …

Biodefense And Constitutional Constraints, Laura K. Donohue

University of Miami National Security & Armed Conflict Law Review

No abstract provided.

Where Is The Justice? The Sexual Assault Crisis Plaguing The Military And A Lack Of Meaningful Justice, Marc Edward Rosenthal

University of Miami National Security & Armed Conflict Law Review

No abstract provided.

Lost In Translation: The Accidental Origins Of Bond V. United States, Kevin L. Cope

Michigan Law Review First Impressions

One of the unusual features of cases about the constitutionality of federal statutes is that they are nearly always foreseeable. Even before the bill’s introduction in Congress, lawmakers are often aware that they are inviting a federal lawsuit. Anticipating a legal challenge, legislators and their staffs attempt to predict the courts’ views of the statute and adapt the bill accordingly. Generally speaking, the bigger the bill’s potential constitutional impact, the more foreseeable the resulting case. By this logic, jurists should have seen the constitutional issues in Bond v. United States from a mile away. In reality, they were foreseen by …

What Will It Take? Terrorism, Mass Murder, Gang Violence, And Suicides: The American Way, Or Do We Strive For A Better Way?, Katherine L. Record, Lawrence O. Gostin

University of Michigan Journal of Law Reform

The assertion that access to firearms makes us safe, rather than increases the likelihood that oneself or a family member will die, is contradicted by a large body of evidence. Gunshots kill more than 30,000 Americans each year. Homicide accounts for approximately one-third of these deaths, with the remainder involving suicides and accidental gun discharges. In fact, firearms put us at greater risk of death than participating in war; in four months, as many Americans were shot dead in the United States as have died fighting in Iraq for an entire decade. Given these grim statistics, it would be reasonable …

Targeted Killing: United States Policy, Constitional Law, And Due Process, Mark Febrizio

Senior Honors Theses

The increased incorporation of targeted killing, primarily through the use of unmanned aerial vehicles, into United States policy raises salient questions regarding its consistency with the U.S. Constitution. This paper contrasts interpretations of constitutional due process with the current legal framework for conducting targeted killing operations. The Fifth Amendment to the Constitution establishes the due process owed to U.S. citizens. This paper determines that the killing of Anwar al-Awlaki, an American citizen, was accomplished in a manner inconsistent with constitutional due process and demonstrates an over-extension of executive branch power. This paper examines one scholarly recommendation that seeks to increase …