Showing posts with label computer evidence. Show all posts
Showing posts with label computer evidence. Show all posts

Saturday, August 13, 2016

Admissibility of Computer Evidence in Criminal Proceedings

Admissibility of Computer Evidence in Criminal Proceedings

https://www.dropbox.com/s/xiz257jktl0owu9/Admissibility%20of%20Computer%20Evidence%20in%20Criminal%20Proceedings%201998.pdf?dl=0
The article *‘Admissibility of Computer Evidence in Criminal Proceedings’ was originally produced back in 1998 and appeared in a publication produced Professor David Bainbridge, Aston University, relating to intellectual property and computer evidence.

After the 1998 article was written changes took place in **law. These changes related hearsay evidence and presumption of a computer operating properly at the material time. In an article “written for a law magazine by Professor Graham Robertson ICAF (now deceased) and me, we discussed the merits the repeal might have impact regarding evidence. We noted:

“However, with rapid advances in computer technology have made Section 69 an increasingly difficult hurdle, primarily for the Prosecution to overcome. In a Report, No. 245, produced by the Law Commission on recommendations on "Hearsay Evidence" about computer material it raised the proposition that computers should be accepted in evidence, as a natural presumption, that they are operating properly at the material, thus recommending repeal of S69 Police and Criminal Evidence Act (PACE) 1984.
“On the 14th April 2000 the legislation necessary to remove the requirement for computer certification was implemented by virtue of Section 60 Youth Justice and Criminal Evidence Act 1999. The effects of this implementation, apparently it brings computer evidence into line with evidence from mechanical sources such as traffic lights and speedometers.”

The purpose of reproducing ‘Admissibility of Computer Evidence in Criminal Proceedings’ is that comments and conclusions stated in the article back in 1998 have in part resurfaced in 2013 as noted in the following materials.....

The extent to which the later 2013 discussions might have impact or introduce change about ‘hearsay evidence’ and ‘presumption’ about computers could require a more in-depth analysis of the impact of cybercrime attacks reported on networks and computers that have soared in recent years and occur virtually on a daily basis in 2016.

Governments around the world have spent many millions of pounds/euros/dollars in financing law enforcement departments and purchasing hi-tech equipment to combat cybercrime and for capturing evidence from networks and computers, the target victims of cybercrime. In the UK, by virtue of the fact the Government acknowledge networks and computers may be compromised, contaminated and unreliable, this position might be difficult (indeed, even be untenable) to reconcile with Statutory law provisions where the Government and Legislature have directed Courts of Law to presume networks and computers are reliable and that hearsay evidence should be allowed on that basis.

Indeed, most law enforcement websites now offer advice about cybercrime, further underpinning the change to the technology landscape that was not around when s.69 PACE was repealed.

Cybercrime might well turn out to be the technology cause that brings about a re-think for the re-introduction of s.69 PACE 1984 or similar legislation with respect to evidence obtained from networks and computers. That might be because back in 1999 when the computer was said to be working properly at the material time or if not would be down to network faults, software glitches or hardware failure in computers etc., it was presumed not to impact on data (evidence) that might be recorded and stored.

However, attacks on varying network protocol layers, malware, ransomware, Cryptovirology etc. weren’t (or were not as much) prevalent back in 1999 and thus would have had a significantly less influence during repeal of s.69 PACE 1984. Had that debate occurred today, of course, it may well be that an entirely different outcome would be reached.
 

Friday, November 18, 2011

Taping Business Mobile Phone Calls - Part 2

Taping Business Mobile Phone Calls - Part 2

Last year the FSA (Financial Services Authority) published its consultation document concerned with recording mobile communications within the finanical services industry http://trewmte.blogspot.com/2010/04/taping-business-mobile-phone-calls.html. I also produced a list of additional statutory and regulatory links to materials about call recording.

The FSA has now concluded their consultation and published CP10/17 which can be downloaded here:

http://www.fsa.gov.uk/pubs/policy/ps10_17.pdf

"2.28 What constitutes ‘reasonable steps’ is fundamentally principles-based, meaning that we are not prescriptive about what we expect from firms to be compliant. Each firm must decide what it deems necessary and reasonable to comply with the taping provisions."

Sunday, October 02, 2011

EF-FPLMN

EF-FPLMN

There are many ways you may wish to approach examining a SIM Card elementary file (EF) and to the university students that wrote and asked for some ideas here are some observations. I would recommend, assuming you have access to SIM reading tools, that it is useful to target a particular EF in the GSM standard GSM11.11. Importantly, as there have been numerous versions and revisions of GSM11.11 it is an essential task to check the various versions and revisions taking account of any changes to the technical requirements for the EF: for instance

a) access conditions
b) content
c) coding
d) etc

To illustrate some of the points raised by this blog discussion I have selected the SIM forbidden list found in elementary file (EF) FPLMN (Forbidden PLMNs) 7F20:6F7B (7F21:6F7B). PLMNs MCC/MNC populated in this EF are those that the MS shall not camp on and provide a location update. 

ETS GSM11.11 v4.21.1 December 1999
GSM 11.11 v8.14.0 June 2007

Of course, when reading the conditions laid out in the standards it is also essential to appreciate the conditions under which a PLMN (MCC/MNC) may be updated into this EF. Trial test conditions should relate to 'automatic' update and update caused by 'manual' selection of a Forbidden PLMN. These are not simple tasks as one might imagine. There is the radio environment to consider? Which PLMNs are forbidden? Is roaming required? The coding of the data? ....and so on. So for an elementary file that largely gets overlooked during examination and ignored in evidence, an analysis of exactly the tasks this EF performs in the SIM module is quite surprising when considering its impact on the MS. That is from the perspective that its evidence could be considered when placing an MS within an PLMN's radio coverage and the follow on potential inference of a geographical location. EF-FPLMN adds an intriguing prospects to be considered, beyond handset and SIM analysis, and that is it can be used in cell site analysis and call record analysis, too.

Extracted and Harvested Data
It is inescapable, thus unavoidable, that validating data that has been extracted and harvested cannot be performed based upon using one tool. Moreover, tools vary in the way they present harvested data and will require the examiner to pay particular attention to ensure the output data (although presented in various arrangements) should be identical. If parity isn't possible then analysis of the tools should be undertaken. It is worth mentioning at this juncture, so as to avoid unduly raising concerns, many tools once released into the marketplace do not allow users to update the product. Changes to SIM techncial specifications or new services or new/change to operators may simply not be included in a tool. 

SIMSpy Trace file Output (Text file)


Other tools present data in varying layouts within the program:

SIM Explorer


SIMCON


SIMCOM


USIM Detective




In conclusion, students asked for some observations and I hope the above may help. Care should be taken when reading the binary not to corrupt content in the EF; to consider the use of reverse-nibble; writing scripts; APDU/PDU and so on, in addition to the automatic and manual tests to be conducted. Moreover, any discovery could also extend to the use of EF-FPLMN to cell site analysis and call record analysis.

Monday, August 15, 2011

Research: critiques of author recognition

Research: critiques of author recognition

With the high-profile Olympics less than 12-months away, the recent looting and rioting that involved the use of voicemail, instant messenging and web-based media and the approach to using "cybercrime" as the new-labelled tool to describe digital investigation and evidential seizure of alleged culpability, these research papers cover some useful ground that might be helpful in evaluating methodology previously unsuspected as fallible to error or mistake, and may have some useful application when applied in author recognition cases which might be relevant to evidence found on mobile phones and computers.

Authors vs. Speakers: A Tale of Two Subfields

The best part of Monday's post on the Facebook authorship-authentication controversy ("High-stakes forensic linguistics", 7/25/2011) was the contribution in the comments by Ron Butters, Larry Solan, and Carole Chaski. It's interesting to compare the situation they describe — and the frustration that they express about it — with the history of technologies for answering questions about the source of bits of speech rather than bits of text.


Practical Attacks Against Authorship Recognition Techniques

The use of statistical AI techniques in authorship recognition (or stylometry) has contributed to literary and historical breakthroughs. These successes have led to the use of these techniques in criminal investigations and prosecutions. However, few have studied adversarial attacks and their devastating effect on the robustness of existing classification methods. This paper presents a framework for adversarial attacks including obfuscation attacks, where a subject attempts to hide their identity imitation attacks, where a subject attempts to frame another subject by imitating their writing style. The major contribution of this research is that it demonstrates that both attacks work very well. The obfuscation attack reduces the effectiveness of the techniques to the level of random guessing and the imitation attack succeeds with 68-91% probability depending on the stylometric technique used. These results are made more significant by the fact that the experimental subjects were unfamiliar with stylometric techniques, without specialized knowledge in linguistics, and spent little time on the attacks. This paper also provides another significant contribution to the field in using human subjects to empirically validate the claim of high accuracy for current techniques (without attacks) by reproducing results for three representative stylometric methods.

Friday, June 03, 2011

Update on Forensic Webblog Posts

Update on Forensic Webblog Posts

Cell Site Analysis
http://cellsiteanalysis.blogspot.com/
-------------------------------------
Radio Survey Field Notes
CSA Training Explanatory Diagram
iOS 4.3.3 deletion of Location Cache
Requesting Cell Site Data

Forensic Mobile Examination
http://forensicmobex.blogspot.com
---------------------------------
Handset Examination in 1995
sn0wbreeze unthethering Windows iPhones
Symbian OS v9.4, Series 60 rel. 5


Examination and Evidence from SIM and USIM Cards
http://sim2usim.blogspot.com
----------------------------
Answer To Reset (ATR)
Blackberry Forensic Analysis


Billing & Call Detail Record Analysis
http://cdranalysis.blogspot.com/
--------------------------------
Vodafone CDR data
Mobile Evidence CDR/Billing Course
Call Detail Record (CDR) GSM Mobile Telephone Call

ABOUT THE BLOGS

Mobile Telephone Blogs Approved Access Only

I have endeavoured to be free with sharing knowledge and information over many years through my blogs, but given the changing economy, UK and global events and advancements in forensics, the nature of the technical content, new developments and examination techniques and legal information will only be accessible to approved law enforcement personnel, security specialists and authorised individuals. The following blogs are now approved access only:

Cell Site Analysis
http://cellsiteanalysis.blogspot.com

Forensic examination and evidence from SIM an USIM
http://sim2usim.blogspot.com

Forensic examination and evidence from Mobile and Smart Phones
http://forensicmobex.blogspot.com

Forensic analysis of Billing and CDR Records
http://cdranalysis.blogspot.com/

Mobile Telephone Evidence (http://trewmte.blogspot.com) will of course remain an open.

The criteria for authorised access to blogs:

a) Law Enforcement
b) Security Services (MI5, MI6, CID, SB, FBI....)
b1) Security Specialists - a proveable record in security for
networks, digital forensics, handsets, SIM, CDR etc
c) Authorised individuals

Tuesday, November 09, 2010

Mobile Telephone Blogs Approved Access Only

Mobile Telephone Blogs Approved Access Only

I have endeavoured to be free with sharing knowledge and information over the years through my blogs, but given the changing economy, UK and global events and advancements in forensics the nature of the technical content, new developments and examination techniques and legal information will only be accessible to approved law enforcement personnel, security specialists and authorised individuals. The following blogs are now approved access only:

Cell Site Analysis
http://cellsiteanalysis.blogspot.com

Forensic examination and evidence from SIM an USIM
http://sim2usim.blogspot.com

Forensic examination and evidence from Mobile and Smart Phones  
http://forensicmobex.blogspot.com

Mobile Telephone Evidence (http://trewmte.blogspot.com) will of course remain an open.

Monday, July 05, 2010

How long will Computer Forensic Standards Last?

How long will Computer Forensic Standards Last?

A police officer switching ON a device that is already switched OFF at a potental crime scene should be an absolute no-no, according to Forensic bibles, case law etc. Indeed, even the Police's official release version of ACPO Guidelines categorically states for Crime Scenes Page 8/66:

"• Do not, in any circumstances, switch the computer on."

Why does this matter? It is a flagrant breach of that principle when we see on "Cops on Camera" ITV 3 Saturday 8pm 4th July 2010 patrol car police stopping a car in Lewisham, questioning the driver about drug related matters (ok, to this point) and then the officer opens the boot of the car and in it he sees a laptop. Did the officer put the laptop in an evidence bag? Oh no, he switches ON the laptop.

The programme clearly demonstrated a major pyschological flaw in the thinking of those who are generating evidential rules vis-a-vis evidential standards. The actions of the Police officer, who I do not think is to blame, actually, because you see the way he went about the task displaying little regard for the rules - which probably means he doesn't know them or they are not enforced properly.

Moreover, it certainly highlights the redundancy of ACPO Guidelines, because what is the point of promoting good practice principles and expect them to be followed in the Lab and at Scene of Crime, yet when it comes to devices in cars or people walking along the street with devices then a wild-west approach of anything goes to deal with the evidence occurs.

Furthermore, it undermines s129 Criminal Justice Act 2003 reliability to seek overt declarations of change to data by ignoring the use of this wild-west approach and reduces the reliability of evidence to nothing more that speculative assumptions. This certainly reveals the slippery slope Lord Steyn raised when as Steyn HHJ R v Minors [1989] 1 WLR 441 he said “if computer evidence cannot be used, much crime would be immune to prosecution also”? For computer evidence to be used it has to be as reliable as possible, at first instance, and reflect the behaviour of the defendant, not the world and his wife who have also had a go at the computer.