ACPO Guide Electronic evidence

The fragile nature of digital evidence, coupled with the complexity and skill required to conduct an assessment that will bear the scrutiny of a court of law, makes it important to independently validate and verify the findings of the forensic assessor.

One of the fundamental tenants ‘Best Practice’ for the evaluation of electronic evidence – including telecommunication data – is that assessments are made on forensically sound and digitally perfect copies of the original media.

This ensures that the target media cannot be tainted or corrupted, and that the original material is retained as Best Evidence for record, independent verification, and presentation in Court.

The first European-based body dedicated to electronic evidence was the ‘FORENSIC COMPUTING GROUP’, formed in 1997 in the United Kingdom. This comprised of various investigative agencies and forensic science units involved in digital evidence. It also had representation from the ‘ASSOCIATION OF CHIEF POLICE OFFICERS’ (ACPO) ‘COMPUTER CRIME WORKING GROUP’.

In 1999 the ACPO Computer Crime Working Group became the first international body to draft Good Practice “guidelines” for the search, seizure and examination of electronic evidence. In particular, these guidelines define the minimum levels of standard for the preservation and analysis of electronic evidence exhibits.

The guideline documents (ACPO Guide Electronic Evidence) have been refined and expanded upon since their original conception, to the current version released in 2010, however, the same core set of principles have remained consistent throughout.

The UK authorities, in consultation with industry experts, have created a ‘GUIDE FOR COMPUTER BASED EVIDENCE’ which defines minimum levels of standard for the preservation and analysis of electronic evidence exhibits. The ACPO Guide Electronic Evidence is built upon four (4) main principles:

o    PRINCIPLE 1: No action taken by Police or their agents should change data held on a computer or other media which may subsequently be relied upon in Court;

o    PRINCIPLE 2: In exceptional circumstances where a person finds it necessary to access original data held on a target computer that person must be competent to do so and to give evidence explaining the relevance and the implications of their actions;

o    PRINCIPLE 3: An audit trail or other record of all processes applied to computer based evidence should be created and preserved. An independent third party should be able to examine those processes, assess an exhibit, and achieve the same result;

o    PRINCIPLE 4: The Officer in charge of the case is responsible for ensuring that the law and these principles are adhered to. This applies to the possession of and access to, information contained in a computer.

Whilst the ACPO Guide Electronic Evidence was originally drafted for assisting in the investigation of computer based crime, it is widely acknowledged in the forensic community that the principles are to be adhered to for all assessments involving digital material, including all forms of electronic evidence, including telecommunication records/evidence.

Read More

Regulation of investigatory powers act 2000

An investigation into people trafficking across European borders, a requirement to tap and listen in on the conversations of a known drug baron, intercepting emails within a paedophile ring, attempting to crack a terrorist’s encrypted drive containing plans for attacks. What does each of these scenarios have in common?

They all require the support of a legislative tool known as the Regulation of Investigatory Powers Act (RIPA).

The RIP Act, commonly referred to as RIPA, was introduced in the year 2000 in order to establish much needed protocols concerning communications data. The act covers interception, acquisition and disclosure of communications, surveillance and human intelligence sources as well as the investigation of electronic data protected by encryption. From a digital investigators point of view, the most relevant of these topics are information encryption and acquisition/disclosure issues.

Obtaining Communications Data

Section 22 with due authorisation and a warrant, any public authority can obtain communications data from a Communications Service Provider (CSP), such as T-Mobile or AOL. The definition of a public authority covers government bodies, the police, as well as local councils or enforcement departments such as Trading Standards.

Communications related data can may be seized by a requested by a public authority for several reasons or in different scenarios. The most immediate of these would be a threat to national security, public health, prevention of injury to a person’s mental or physical health and the prevention of a crime. However, the RIP Act also covers less serious circumstances where charges may need to be collected or assessed by government and for any issues relating to the general well-being of the United Kingdom economy. Authorisation will be valid for one month and no further data can be legally collected after this time period without further authorisation.

Collection and Investigation of Encrypted Data

Encrypted data can be a significant hurdle to digital forensics and can bring an investigation to a total standstill. In the event that encrypted documents, drives, e-mail, conversation logs or other forms of electronic media are discovered, procedures must be followed in accordance with RIPA.
Under section 49, a disclosure requirement must be imposed by an authorised personan authorised person must impose a disclosure requirement if suitable grounds for doing so are met. In terms of encrypted information, a disclosure requirement must be used when there reasonable belief or evidence to suggest that a person has the key to decrypt communications data. Again, threats to national security and crime can help provide further need for measures to decrypt protected information.

Disclosure requirements must describe the encrypted data for which the requirement has been created, on what grounds it has been issued, the time allowed to comply with the notice and information regarding the authorised person providing the notice. Total secrecy surrounding a disclosure notice must be adhered to under section 54 of the RIP Act. Any ‘tipping off’ can result in a person facing imprisonment or a fine.
If a person knowingly fails to comply with a disclosure requirement and does not provide the necessary authority with the key to encrypted data, that person may be subject to two years imprisonment or a fine under section 53 of RIPA. This is commonly a difficult area in digital evidence as encrypted communications may have the potential to imprison a suspect for more than the two years for not providing a key. Those who do not comply with the RIP Act when intercepting, obtaining or otherwise dealing with evidence will be liable to criminal or civil proceedings.

Read More

Facebook Evidence

Facebook™ is a social networking service that allows users to interact with other Internet users, sharing media and messages.

A user is able to contact other individuals by adding them to their ‘friends list’, which enables them to be able to write on other friends’ walls (i.e. a space for public commentary) and leave tags on photographs. Users are also able to communicate by sending instant messages which can sometimes be stored on the user’s machine and messages, similar to emails.

The owner of the account is able to adjust privacy settings so as to restrict what information is publically accessible and what details may be viewed only by friends. Much like conventional email correspondence, sent and received messages are unable to be edited and are stored on the Facebook™ servers in their original format until deleted by the user of an account. This material is the basis for facebook evidence.

Correspondence made via Facebook™, including media files uploaded to the website or shared, are stored permanently on the respective account.

It is necessary for the user to manually select items of correspondence or specific files for deletion in order to have them removed from the account. Alternatively, a user may close their entire account in order to have all correspondence or media files erased. Deleted data files or accounts are no longer available to members of the public, online friends or the original account owner; however, all of this content remains archived by Facebook™ for a period of ninety (90) days .

Facebook™ recommends that investigators contact their organization as soon as a requirement for acount information is known. This way current accounts or erased content can be preserved for a further ninety (90) days, to allow adequate time for service of legal applications.

The Facebook™ unit responsible for managing requests for account information and related facebook evidence, the unit is titled the ‘Security Department and Custodian of Records’:

FACEBOOK™ INC

SECURITY DEPARTMENT / CUSTODIAN OF RECORDS

1601 CALIFORNIA AVENUE

PALO ALTO, CA 94304

FAX: (650) 644 3229

EMAIL: SUBPOENA@FACEBOOK™.COM

The following three types of requests can be made:

•             Preservation Requests

Following notification of a specific User ID, Username or e-mail address, existing account records and erased archive material will be preserved for ninety (90)days.

•             Formal Legal Requests

Records will be provided pursuant to formal compulsory legal process issued under US law.

•             Emergency Requests

Where there is a credible risk of bodily harm or death, immediate assistance will be provided to investigating authorities, even in the absence of legal process/orders. It should be noted that whilst the above references state that formal legal facebook evidence requests “issued under US law”, in the experience of the author the Facebook™ organization will readily assist any request for information from any lawful authority or country, as long as supported by their respective legal process.

Whilst internal procedures vary between Police forces, this position may be verified by contacting the relevant Hi-Tech Crime Unit (HTCU) and/or Single Point of contact (SPoC) for clarification on their approach to securing disclosure of facebook evidence, account information and related records. Subject to receiving a lawful request for information, Facebook™ can provide the following records:

•             Basic Subscriber Information

Previously referred to as ‘neoselect’ , these records will include the User Identification Number, account email address, time/date of account creation, associated telephone number(s), and time/date of logins for the past 72hours.

•             Expanded Subscriber Content

Previously referred to as ‘neoprint’, these records will include all profile contact information, status updates, files/photographs that have been shared, messages posted on other individual’s walls, listings of friends and group memberships, and event reminders.

•             User Photographs

Previously referred to as ‘photoprint’, this will include all photographic media uploaded by the account holder as well as photographs from third parties which have been tagged as featuring the account holder.

•             Messaging Correspondence

Incoming (received), outgoing (sent), and draft email equivalent communications.

•             Internet Logs

Commonly referred to as ‘IP’ logs, this content will assist in demonstrating the time/date that a user account was accessed as well as provide enough information to trace the physical address of the computing device used to make the account access.

The above facebook evidence records will generally be served via email in the form of Adobe Portable Document Format (PDF), so that the content cannot be easily modified.

Read More

An introduction to Cell Site Analysis

The Soham murders involving Jessica Chapman and Holly Wells was one of the most high profile cases to be reported and documented in the last ten years. Cell site analysis played a critical part in the investigation throughout and ultimately helped to convict Ian Huntley of murder.

Cell site analysis aims to determine the geographical location of a mobile phone through analysis of data records, transmit and receive beacons (cell sites) and signal strength of a specific area. Although not an exact science, it is a technique that can be applied by expert witnesses to help defend or prosecute a suspect during a case relying on mobile phone evidence.

Statistics show that in December 2008, over 75 million mobile phones were active in the United Kingdom alone. This figure confirms a larger portion of mobile phones today than there are people (estimated 62,041,708). It is therefore no wonder that Cell Site Analysis (CSA) is an increasingly important forensic and investigative technique used in the UK today.

During the investigation in Soham, Police questioned all males about their whereabouts at the time of Holly and Jessica’s disappearance and asked for a contact mobile number. Ian Huntley initially insisted that he had been out of Soham at the time that the alleged incident occurred. However, phone records and cell site analysis in the area suggested that Huntley’s phone had been used in the vicinity of his home and that one of the girls phones had been switched off in the same area around the time of disappearance. The combination of this evidence, general policing and the investigation eventually lead to the sentencing of Ian Huntley.

Cell sites, or ‘masts’, are often placed on tall buildings or on masts in order to achieve the best coverage possible. Whilst some masts have antennae that transmit in three directions (full 360 degrees), some may only transmit in one and produce limited directional coverage. The cell site analysis expert must therefore determine what type of mast has been used in order to collect the most reliable results possible during an investigation. Each antennae in use by a cell site will also have a unique reference that is recorded and included on mobile phone data records (with the exception of network O2 who reference cell sites but not individual antennae). These unique references form the basis for cell site analysis and confirm what mast was in use by a suspects mobile phone and when.

Although cell sites have the ability to transmit over large distances, signal quality can be less effective or entirely blocked by tall buildings, condensed objects and other obstructs. Users in these ‘black spots’ may experience a decrease in communications quality or a complete halt to mobile phone services. In these instances, a mobile phone could connect to another large cell site with better coverage or to smaller cell sites known as picocells, microcells and femtocells if one were available. Picocells, microcells and femtocells are placed in black spots and other difficult areas (such as train stations) in order to provide a good service that a large cell site cannot achieve. Although each provides a slightly different type of service, they all allow for basic mobile phone communication such as short message service (SMS) and conversations.

Read More

eDiscovery and Forensic Accounting

In a world where technology is constantly evolving and being utilised, computer forensic techniques and E-discovery play an increasingly important role in forensic accounting. Fraud, in particular, is a problematic area of crime that commonly requires both computer forensic and forensic accounting expertise.

E-discovery is the process of identifying, preserving and presenting electronically stored information that may be relevant to criminal or civil litigation. In fraud, E-discovery is rapidly being depended on by forensic accountants and the Court to recover evidence that may not have been found through analysis of non electrical evidence such as paperwork.

E-Discovery of relevant evidence

Metadata is detailed information stored in relation to an electronic item when it is opened, saved or created by a user on a computer device. Some metadata cannot be viewed without the use of specialised analysis tools. Therefore, it must only be recovered by an experienced investigator using computer forensic techniques.

Metadata is crucial when analysing potentially relevant items on an electronic exhibit. It can reveal time and date attributes, the original and last author of an item, its save path, the program used to create or open the file and more. Dates of access are especially significant due to their ability to indicate the last time a file or item may have been opened by a computer user.

Documents located on an exhibit may contain invoice, trading or bank account details that can ultimately be linked with a suspect or confirm the innocence of a person. Spreadsheets are a popular and commonly used type of document for storing financial details that can provide a wealth of information regarding the activities of a suspect. Upon recovering potentially significant documents for a fraud case, findings can be sent to a forensic accountant for further analysis.

Internet history can also provide an investigator with evidence regarding online banking or other financial activities. When a user enters form data such as banking details to access their account online, this information is sometimes stored on the drive in different forms. It is then possible through use of forensic techniques to identify relevant information that could be useful to forensic accountants such as sort codes or account numbers. Internet history records can be attributed to individual users using a computer system.

Communication between a suspect and others potentially involved in a fraud case can be uncovered through analysis of instant messaging programs or Email messages. Instant messaging programs are increasingly popular and some social networking sites such as MySpace and Facebook incorporate their own ‘chat’ tools into their websites. In the instance that suspects were through to have been communicating over social networking sites, it is sometimes possible to recover fragments of conversation or their online profiles. Such information could aid a forensic accountant if the conversation was money or fraud related.

Other instant messaging programs can be installed to a computer device rather than through an online application. In these instances, it is sometimes easier to recover conversation logs if they have been saved to an exhibit. Files can also be transferred between contacts over an instant messaging client that could potentially aid an investigation if the item is relevant to the case (invoices, bank statements etc).

Emails provide an examiner with Email addresses that a suspect has been using as well as detailed correspondence. This correspondence may be able to confirm whether a person has been posing as someone else, attempting to involve potential victims into a fraudulent operation or details of illegal activities. Another aspect of Email includes attachments which may contain relevant files to a fraud case. In the event that potentially significant attachments are found, a record should be kept of the Email address that sent the Email containing the attachment, the recipient of the Email and what the attachment contained. This detailed summary and the attachments can then be sent to the forensic account who determines whether they are relevant or not in terms of finance.

Emails and instant messaging can provide detailed information on those who may be involved in a fraudulent operation, especially in situations where invoices or bank account details reveal a different name of address from that of the original suspect. Although these details may be fake as part of the operation, such data can still help a forensic accountant piece together an entire chain of events.

After exhibit investigation

All recovered information is then sent to a forensic accountant for further analysis after it has been exported from the exhibit in a forensically sound manner. If the forensic accountant obtains new information from analysing the electronic items and they suspect that more related data may be located on the drive, the investigator can return to the exhibit and retrieve the information if possible.

Conclusion

Forensic accountancy commonly depends on the expertise of computer forensic investigators to retrieve potentially relevant information to a fraud case from an electronic exhibit. Investigators are able to recover hidden information from an exhibit in a forensically sound manner so that any material retains perfect integrity. An increasing use of technology would indicate that more people will use computer devices and related programs to commit fraud.

Read More

Expert Witness

Technical evidence is a common feature in today’s criminal trials. Whether CCTV footage of an armed robbery, paedophilic images stored on a computer, or text messages recovered from telephones seized as part of a drug conspiracy – electronic evidence may have a profound effect upon the proceedings and be fundamental in establishing innocence or guilt.

The investigation, analysis, and presentation of findings to the court is conducted by a subject matter specialist; an individual that is known in a legal sense as an ‘Expert Witness’.

The concept of using specialists in English courts to assist the judge and jury can be traced back to a litigation matter in 1782 that was concerned with the silting-up of Wells harbour in Norfolk. The court heard oral testimony from a leading civil engineer; Mr John Smeaton, and was guided by his insights into the evidence.

Whilst the practice of seeking advice from independent specialists continued over the decades, it was still considered something of a rarity; exemplified by the comments of Lord Justice Patrick Devlin who was overseeing the Old Bailey trial of suspected serial killer Dr John Bodkin Adams and commented in his summing up that “it is a most curious situation, perhaps unique in these courts, that the act of murder has to be proved by expert evidence.”

The concept, function and responsibilities of an expert witness have been clarified over the years and formally expressed in the Civil Procedure Rules 1998 (CPR), which hold that this designation must be reserved for an individual who has had specific training, education or experience that will permit them to provide authoritative commentary on evidence. Ultimately the expert may be considered an agent of the court and under the Criminal Procedure Rules 2010 (33.2) this “duty overrides any obligation to the person from whom he receives instructions or by whom he is paid”.

It is the responsibility of the presiding judge to consider whether an individual may be considered an expert witness for the purposes of the court. Generally a two tier test; as adopted in R v BONYTHON [1984] SASR 45 is applied: (1) whether the subject matter of the opinion falls within the class of subjects upon which expert evidence is permissible; and (2) whether the witness has acquired by study or experience sufficient knowledge to render his opinion of value to the court.

An important judgement from R v GOKAL (Court of Appeal, Criminal Division, 11 March 1999) clarified an important question as to the admissibility of evidence where the bona fides of the specialist were not in question but a concern may be raised as to independence. It was decided by the courts that in such circumstances evidence should be heard, though the ‘weight’ and importance must be considered carefully by the judge and the jury must consider the ‘weight’ and importance carefully.

In criminal proceedings in the United Kingdom it is common for both the Crown (the party advancing a prosecution) and the defence to instruct expert witnesses to assist their respective case preparations. In certain circumstances both sides may agree on the instruction of a single specialist, a ‘Single Joint Expert’ (SJE), however, whilst this approach can simplify matters and reduce costs it does introduce the risk of eliminating any peer-review of the conclusions. As a result the selection of a truly independent expert is of paramount importance.

Where separate experts are involved in proceedings the court encourages the it is encouraged by the courts for these parties to impartially assess the evidence and produce a witness statement or expert report. These documents must outline their respective qualifications/experience, the matters they have been asked to consider, their methodologies used, their reliance upon any scientific principles, their tests, findings, and the conclusions they draw.

The expert witness is privileged to be permitted to pass opinion; though it should be qualified and based upon the evidence and their interpretation of such.; t These statements or reports become evidence in the trial proceedings and so it is important that their content is clear, balanced, and can withstand scrutiny. Having considered the expert report served by a third party, the instructed experts are advised to meet and discuss their evidence in what is known as an ‘expert conference’. Often these meetings are held in strict confidence without the presence of the legal teams in an effort to encourage frank and open dialogue. As is said in the Russian proverb: “doveryai, no proveryai” (trust but verify). The intention is to allow the specialists to review the evidence, find areas of common ground, and narrow the issues for consideration by the court. The net result is to produce a jointly signed statement that details the evidence, any interpretation of the findings, and where any difference of opinion may feature.

In extremely serious proceedings the trial process may be temporarily suspended to allow the experts to consider the evidence, formalise their results, and attempt to secure a level of agreement (R v DAVIES & ORS; money laundering and drugs conspiracy [2008, Liverpool]).

The old adage of being “only as good as your last case” is often heard in the legal community. This is acutely true for the expert witness. Reputation and integrity are extremely important and a single finding of fault by a judge can dash all career prospects. Where an individual’s independence or expertise has been called into question it is common for the governing body for that industry to consider disciplinary proceedings. Where an individual has been found to have misled the court criminal proceedings can be instigated for perjury or perverting the course of justice. It should be noted that in the eyes of the law perjury is considered one of the most serious of offences as it is said to strike at the heart of the justice system (R v ARCHER [2003] 1 Cr.App.R. S 86).

The pillars of education, experience and certification are cornerstones for establishing a reputation as a specialist that may be called upon as an expert witness. These must be tempered with personal traits of professionalism and unquestionable integrity. For technology professionals, a relevant degree is considered a must and may be complimented by a masters or doctorate in the field of specialism. Certifications also hold an important place – whether vendor neutral, such as the ‘Certified information Systems Security Professional’ (CISSP), or relating to a specific technology – providing a level of assurance as to competence in a field.

However, textbook theory and paper qualifications are no substitute for experience at the ‘coal face’; it is common for technical forensic analysts to spend several years in a junior capacity at an established laboratory assisting qualified specialists in their assessments. They may work on several hundred or even thousands of cases before they can be considered by their peers to be competent to conduct evaluations on their own.
Once an individual has significant and verifiable experience, they may undergo vetting by an independent body such as Sweet & Maxwell, the Academy of Experts who conduct peer-reviews on applicants by established experts in a field and document successful candidates on an ‘Expert Witness Register’.

Summing Up
Finally, the aspiring expert needs to secure significant court room experience – being admitted by the trial judge as an expert witness, having evidence critiqued, and oral testimony subjected to cross-examination.

A career as a digital evidence expert witness can be rewarding, fascinating, and frustrating in equal measures! Individuals with acute attention to detail, true depth and breadth to their understanding, and a desire to make a difference may find it appealing. Long hours, exposure to emotive subjects and confrontation are also realities of the industry. It can also be an intimidating and a lonely field – at the end of the day there is only one person in the witness box. “Caveat expert” – let the expert beware.

Read More

An 11 year old girl has been placed under Police protection after receiving death threats from users on the anonymous 4chan online image boards.

The girl known as 'Jessi Slaughter', initially posted a video of herself insulting users on a teen gossip which was posted on the 4chan boards for all users to see. Her full name, phone number, address details and other sensitive data were then posted on the website for users to play pranks on her.

Jessi and her family were then placed under Police protection after receiving death threats and other abuse from Internet users who had seen her personal details on 4chan. All of her social networking accounts have also been hacked and vandalised as a result.

Recently, there have also been rumours that indecent images of the girl exist online. The Florida Sheriffs department are now carrying out a full investigation into this.

Read More