Deborah W. Keeling

Node-Based Probing and Monitoring to Investigate Use of Peer-to-Peer Technologies for Distribution of Contraband Material

We consider the requirements for node-based probing and monitoring for network forensic investigation of the use of peer-to-peer technologies for distribution of contraband material. The architecture of peer-to-peer (P2P) data exchanges must be examined for opportunities to capture data on the transfer of contraband data with a focus on node structures in P2P exchanges. This examination is of technical, social and legal aspects of P2P use leading to the design and testing offorensically-sound investigative tools and protocols. Computational research must examine: 1. Undercover Node-based Probing and Monitoring to Build an Approximate Model of Network Activity 2. Flagging Contraband Content (keyword, hashes, other patterns) 3. Evaluation against different recipient querying, distribution and routing cases 4. Using the Evaluation results to fine-tune the node positioning strategy Legal and social research is needed to examine the U.S. and transnational legal constraints on the use of particular tools and the presence of possible behavioral signatures.

Evidentiary Power and Propriety of Digital Identifiers and the Impact on Privacy Rights in the United States

Media and network systems capture and store data about electronic activity in new, sometimes unprecedented ways; computational systems make for new means of analysis and knowledge development. These new forms offer new, powerful tactical tools for investigations of electronic malfeasance under traditional legal regulation of state power, particular that of Fourth Amendment limitations on police searches and seizures under the U.S. Constitution. But autonomy, identity and authenticity concerns with electronic data raise issues of public policy, privacy and proper police oversight of civil society. We examine those issues and their implications for digital and computational forensics.

Legal/forensic concerns in the analysis of digital device hardcopy output

The digital computer as the tool for crime has expanded the ability of miscreants to commit “informational” offenses that once required significant skill and expertise. The misuse of such devices may produce a variety of nefarious outputs in both electronic and hardcopy form. We examine forensic issues as to the hardcopy output of digital devices used in counterfeiting obligations and securities and the importance of a proffer of indicia of reliability of forensic analysis. This includes evidence of reliability of expert testimony. The forensic impact of this extends from criminal investigations into general forensic concerns and archival and historical work seeking to document the attribution, authenticity and provenance of our social and cultural heritage.

Boundary Conditions for the Digital Forensic Use of Electronic Evidence and The Need for Forensic Counter-Analysis

Network and Digital Forensics provide information about electronic activity in new, sometimes unprecedented forms. These new forms offer new, powerful tactical tools for investigations of electronic malfeasance when incorporated under traditional legal regulation of state power, particular that of Fourth Amendment limitations on police searches and seizures under the U.S. Constitution. These tactical tools raise issues of public policy and privacy that may raise concerns about the proper police oversight of civil society. How those issues are resolved will define personal privacy, autonomy and dignity in the 21st digital century.

Computer Forensics And Electronic Evidence - Failure of Competent Computer Forensic Analysis And Other Computer-Related Acts As Ineffective Assistance Of Counsel

American defendants have the right to the effective assistance of counsel in criminal prosecutions pursuant to the Sixth Amendment to the U.S. Constitution. We examine how the effective assistance of counsel addresses competence and expertise with computer and digital forensics and electronic evidence. There is a floor of competence in modern litigation requiring competence as to the use of computer forensic services, at least in cases where electronic evidence is used. This is an area that is only now developing and which will continue to evolve. Examination of reported United States cases show a significant increase in the referenced use of computer forensics from 2004 through 2010, indicating significant growth in the use of digital forensics. Digital forensics has also been referenced by the courts, thought to a lesser degree. There are also the first reported cases to appear that assert defense counsel was ineffective for not using such counsel, asserting that counsel was not competent in that failure. The numbers of such cases, though, are too small to indicate anything other than the appearance of this concern as a matter required of competent counsel. Nonetheless, it may indicate a growing use and expectation of competence in the use of computer and digital forensic expertise in the analysis of electronic evidence.

Digital System, Evidence & Forensics Issues in Correctional Environments

The correctional environment is one of the most controlled in the United States. Despite the regimentedsystem that epitomizes correctional facilities, digital systems have entered that environment as contraband anddata backchannels subject to compromise that threaten control of institution and the effectiveness of incarceration for the incapacitation of offenders. We examined data on this issue and possible solutions.

A Distributed Triage Model for Digital Forensic Services to State and Local Law Enforcement

We propose a distributed triage model for digital forensic services to state local law enforcement. This would permit efficient use of forensic resources by using local law enforcement for basic digital forensic analysis and assigning more complex matters to intermediate and advanced examiners.

Implications of Attorney Experiences with Digital Forensics and Electronic Evidence in the United States

The experiences of lawyers with electronic evidence and digital forensics are examined. The assessment indicates disparate experiences based on case type as to 1) the use of different types of electronic evidence, 2) disputes over that use and 3) utilization of digital forensics experts. Further study indicates use of electronic evidence continues to increase, from which we infer increased challenges to the reliability of digital forensic testimony.

Positing social and justice models for cyber security

Cyber security should consider criminal justice and social education models to secure the highly distributed elements of the information network, extend the effective administration of justice to cybercrime and embed security awareness and competence in engineering and common computer practice. We examine models of such behavior.

Legal Issues for Research and Practice in Computational Forensics

These special issues of reliability require that the principles, method, application and expert using a CF system be validated as accurate, relevant, competent and appropriate for use by a finder-of-fact to an identified level of confidence. This testing for appropriate forensic use is especially important as conclusions from the results of these systems may have serious impact on the life and liberty of individuals. Researchers in computational forensics may be challenged as to AbsTRACT