Computer Forensics Chapter 7

Computer Forensics and Cyber Crime

• Chapter 7 discusses avenues for prosecution and government efforts.
• Learning objectives include knowledge of traditional statutes applicable to computer crime, federal legislation on online behavior, investigative tools, data mining programs, and international approaches to solving computer crime.

Introduction

• Law enforcement faces challenges like smaller agencies with fewer resources, reliance on state/federal agencies, historical apathy towards nonviolent crimes, and slow legislative action.

Traditional Statutes

• Primary federal provisions (Title 18) cover crimes like fraud, embezzlement, terrorism, child exploitation, stalking, kidnapping, forgery, extortion, RICO, access device fraud, and illegal wiretapping.
• Supplemental federal law (Titles 15 and 17) covers credit card fraud, software piracy, and copyright infringement, respectively.

The Evolution of Computer-Specific Statutes

• The Computer Fraud and Abuse Act of 1986 (CFAA) initially focused narrowly on unauthorized computer access. Later expansions applied it to computers used in commerce, communications, and financial records; specifically targeting intentional intrusions rather than accidental ones.
• Subsequent successful prosecutions involved notorious individuals like Kevin Mitnick, Shadowhawk, and Robert Morris.
• The National Information Infrastructure Act of 1996 (NIIPA) addressed loopholes in the CFAA, particularly accidental intrusions, computer-related offenses, and instances where computer data wasn't the primary target.
• Subsequent expansions to the CFAA included transmitting classified government information, accessing private sector computers, financial institutions, and U.S. government systems. Fraud related to various activities, hacking and programming, unintentional damages, and extortion are also covered.

Evolving Child Pornography Statutes

• Efforts to ban child pornography include piecemeal legislation, such as the Protection of Children Against Sexual Exploitation Act of 1977, and Supreme Court rulings.
• The Supreme Court has ruled in cases like New York v. Ferber (1982) that child pornography is not protected by free speech. Subsequent legislation like the Child Protection Act (1984) and Child Pornography Protection Act (1996) aimed to address increasing concerns.
• The PROTECT Act offers solutions for protecting children from exploitation, including mandatory life sentences for repeat offenders, criminal checks for volunteers, and electronic eavesdropping in cases of abuse.
• The PROTECT Act also prohibits pretrial release for certain offenders, ended statutes of limitations on child abduction/abuse, and established a National AMBER Alert Coordinator.
• The Miller standard of obscenity has been applied to various forms of child pornography, leading to sentencing enhancements.

Identity Theft and Financial Privacy Statutes

• The Identity Theft and Assumption Deterrence Act of 1998 (ITADA) criminalizes possessing another person's identifying information and knowingly transferring/using such information for unlawful purposes.
• Identifying information encompasses names, social security numbers, dates of birth, driver's licenses, alien registration, passports, and employer/taxpayer identification numbers.
• Unique biometric data (fingerprints, voice prints, iris scans) is also covered under this act
• Financial institutions were required to disclose privacy practices and provide "opt-out" options for disclosing personal information.
• The Financial Modernization Act of 1999 contains safeguarding rules that stipulate security measures for protecting such information.
• The Fair and Accurate Credit Transactions Act (FACTA) of 2003 introduces free credit reports, fraud alerts, and truncation of credit/debit information to combat dumpster diving, and social security numbers.
• FACTA also mandates investigation of address changes, blocking of fraudulent information, and requirements for consumer reporting agencies. Card issuers must also investigate new card requests due to address changes
• Debt collectors now must apprise third-party employers of potential identity theft-related debts.
• These statutes are intended to prevent and prosecute fraud, limit the comingling of medical and financial information, and require more protections for victims and to provide appropriate recourse.
• The Identity Theft Penalty Enhancement Act of 2004 established criminal penalties for aggravated identity theft, often including mandatory sentences. The Identity Theft Enforcement and Restitution Act of 2008 further expanded consequences for identity theft, including restitution.
• The Drivers Privacy Protection Act and the Health Insurance Portability & Accountability Act (HIPAA) restrict the use of personal information from motor vehicle records and the disclosure of social security numbers and health information.

Federally Funded Initiatives and Collaborations

• The President's Working Group investigated the sufficiency of existing laws, the need for new technologies, legal authorities to investigate and prosecute, and the efficacy of education in minimizing risks.
• Resulting approaches involve regulating internet criminal activity paralleling traditional law. Recognizing and addressing the special needs of investigators and agencies involved in investigations (interagency and international cooperation), developing cyber ethics curricula, and supporting private sector training.
• Presidential Decision Directive 63 (PDD 63) established the National Infrastructure Protection Center (NIPC) and Infragard to bring together various entities for threat discussions. A notable initiative, the Innocent Images initiative, focused on investigating and prosecuting interstate travel associated with illicit activities involving minors.

Law Enforcement Operations and Tools in the United States

• Technologies like packet sniffers (Carnivore, Packeteer, Coolminer) and key loggers (Magic Lantern) are utilized during investigations.
• Data mining, encompassing statistical modeling, algorithms, AI, uses large datasets to analyze associations, sequences, classify events, cluster previously unknown facts, and forecast future activities. The process is used to identify potential terrorists, including programs like TIA, Secure Flight, CAPPS II, MATRIX, and ATS.
• Collaboration within federal, state, or local task forces, as well as interagency partnerships like the Cyber Science Laboratory and groups like the High Tech Computer Investigators Association (HTCIA) promote knowledge sharing and training.

International Efforts

• OECD and the Council of Europe's Select Committee initiated efforts to harmonize laws for computer-related offenses. Recommendations were produced to make behaviors like data/program alteration, computer espionage, and unauthorized computer use, among others illegal.
• Mandatory offenses (e.g., computer fraud, forgery, computer sabotage) were suggested for all countries.
• Agencies like the Council of Europe and Interpol have taken steps to tackle transnational cybercrime. The Virtual Global Task Force and the United Nations' Convention against Transnational Organized Crime contribute further to the fight against cybercrime.
• The Association of Southeast Asian Nations (ASEAN) shows a shared interest in training, criminal legislation, and international collaboration to counter cybercrime.

Conclusions

• Recognition of cybercrime problems has substantially escalated, but significant work remains.
• Despite ongoing international cooperation, issues concerning national sovereignty pose challenges to ongoing efforts in cybercrime investigation/prosecution.
• Continued reliance on existing traditional statutes alongside updated legislation relevant to technology remains a key strategy for addressing this challenging issue.

Explore the legal frameworks and governmental efforts in prosecuting cyber crime in Chapter 7 of Computer Forensics. This quiz covers traditional statutes relevant to computer crime, investigative tools, and the evolution of computer-specific laws. Assess your understanding of these critical issues facing law enforcement today.