Dulani Woods

Cloud-Trust—a Security Assessment Model for Infrastructure as a Service (IaaS) Clouds

The vulnerability of cloud computing systems (CCSs) to advanced persistent threats (APTs) is a significant concern to government and industry. We present a cloud architecture reference model that incorporates a wide range of security controls and best practices, and a cloud security assessment model—Cloud-Trust—that estimates high level security metrics to quantify the degree of confidentiality and integrity offered by a CCS or cloud service provider (CSP). Cloud-Trust is used to assess the security level of four multi-tenant IaaS cloud architectures equipped with alternative cloud security controls. Results show the probability of CCS penetration (high value data compromise) is high if a minimal set of security controls are implemented. CCS penetration probability drops substantially if a cloud defense in depth security architecture is adopted that protects virtual machine (VM) images at rest, strengthens CSP and cloud tenant system administrator access controls, and which employs other network security controls to minimize cloud network surveillance and discovery of live VMs.

Air Attack Against Wildfires: Understanding U.S. Forest Service Requirements for Large Aircraft

A RAND study sought to help the U.S. Forest Service determine the composition of a fleet of airtankers, scoopers, and helicopters that would minimize the total social costs of wildfires, including the cost of large fires and aircraft costs. The research team developed two models to estimate the social costminimizing portfolios of firefighting aircraft. Both models favored a fleet dominated by scoopers for the prevention of large fires

Identifying Law Enforcement Needs for Access to Digital Evidence in Remote Data Centers

L aw enforcement increasingly needs to have access to data residing in remote data centers, and investigators frequently face multiple barriers in this process. As more data routinely collected by investigators have come to reside in remote locations, these barriers have become a growing challenge for stakeholders. On behalf of the National Institute of Justice (NIJ) and as part of the Priority Criminal Justice Needs Initiative, the RAND Corporation, in partnership with the Police Executive Research Forum, organized a workshop in May 2017 on Challenges with Law Enforcement Access to Digital Evidence Held in Remote Data Centers. The workshop brought together experts on the acquisition and use of digital evidence and on relevant law and technical issues from around the United States to discuss challenges associated with law enforcement requests for digital data held by third parties that may reside across state or national boundaries. Discussions focused on ambiguities in U.S. law and procedure, challenges associated with using the Mutual Legal Assistance Treaty (MLAT) process, issues stemming from inadequate cooperation between law enforcement and service providers (the companies and organizations providing remote storage, communication, and computing services), and technical issues related to evidence residing in the cloud. During the workshop, participants discussed specific problems they faced and identified 36 needs for mitigating those problems. Needs, in this case, are the means of solving a key problem or improve performance over the baseline. As such, a need includes both a problem or an opportunity, as well as a related solution or innovative idea. Following this discussion, the needs were prioritized using the Delphi Method to produce a ranked list of high-priority needs (RAND Corporation, 2017). The highest-priority needs revolved around the creation of information exchange systems, better online training and standards, and incentives • Expert panelists on the acquisition and use of digital evidence and

Using Social Media and Social Network Analysis in Law Enforcement: Creating a Research Agenda, Including Business Cases, Protections, and Technology Needs

I n April 2017, the National Institute of Justice convened an expert panel to assess, and identify high-priority needs for, law enforcement’s use of two closely linked technologies that have potential to provide key information needed to address crime risks, hold offenders accountable, and ensure physical safety: social media analysis and social network analysis. Social media analysis consists of methods and tools to collect and analyze text, photos, video, and other material shared via social media systems, such as Facebook and Twitter. Social network analysis is a type of data analysis that investigates social relationships and structures as represented by networks (which can also be called graphs). Social media, given that it reflects relationships inherently, is a key source of data for social network analysis; conversely, social network analysis is one key type of social media analysis. In all, the panel discussed five core business cases for employing social media analysis and social network analysis in law enforcement:

Modeling Dr. Dynasaur 2.0 Coverage and Finance Proposals: Effects of the Expansion of Vermont's Dr. Dynasaur Program to All Individuals Through Age 25

The authors assessed an expansion of Vermonts Dr. Dynasaur program that would cover all residents age 25 and younger. The current Dr. Dynasaur program combines Vermonts Medicaid program and Child Health Insurance Program for children ages 0 through 18 to provide a seamless insurance program for those with family incomes below 317 percent of the federal poverty level. The authors used RANDs COMPARE-VT microsimulation model with Vermont-specific demographic, economic, and actuarial data to estimate the effects on health insurance coverage, costs, and premiums. They also identified the new revenues required to fund the program expansion and explored three alternative financing strategies to raise those funds: (1) an increase in the Vermont income tax, (2) a Vermont payroll tax, and (3) a Vermont business enterprise tax. The authors found that enrollment would increase by more than 260 percent under the 100-percent enrollment scenario and by nearly 200 percent under the 70-percent enrollment scenario by 2019. Not surprisingly, the children and young adults who move off employer-sponsored insurance (ESI) and into Dr. Dynasaur 2.0 have considerably lower expected health care costs than those who remain on ESI, increasing the per-person premiums by nearly

Caring for Those in Custody: Identifying High-Priority Needs to Reduce Mortality in Correctional Facilities

1,000 for those remaining enrolled in ESI. Annual health care expenditures per person for children and young adults in 2019 are estimated at

Future-proofing justice: building a research agenda to address the effects of technological change on the protection of constitutional rights

4,325 with Medicare prices. The combination of increased reimbursement rates, large increases in enrollment, and relatively low Dr. Dynasaur premiums (no more than

Using Future Broadband Communications Technologies to Strengthen Law Enforcement

720 per year) will require significant new tax revenues to meet program obligations.

Current and Projected Characteristics and Unique Health Care Needs of the Patient Population Served by the Department of Veterans Affairs

T he health and safety of inmates in correctional facilities is generally not an issue that garners much public attention. Indeed, for most people, the knowledge that our prisons and jails are fortified against escape is sufficient; the general public has comparatively little knowledge of what goes on behind the walls, including the welfare of inmates and how incarceration can affect their health and safety. In recent years, however, national attention has been increasingly focused on this issue as the mortality rate for inmates confined in correctional facilities has been on the rise. According to the Bureau of Justice Statistics (BJS), the number of inmates who died in U.S. correctional facilities increased each year from 2010 to 2014 (Noonan, 2016a; Noonan, 2016b). In 2014, the last year for which data are available, a total of 4,980 inmates perished, an increase of 130, or nearly 3 percent, from 2013. In state prisons, the mortality rate was 275 per 100,000 and was the highest since data collection began in 2001. Illness and disease have consistently accounted for the vast majority of all deaths: 87 percent in 2014. However, suicide in prisons increased 30 percent from 2013 to 2014 (Noonan, 2016b). In jails, the 2014 mortality rate of 140 per 100,000, primarily driven by increases in suicide, was the largest since 2007 (Noonan, 2016a). Beyond the compilation of statistics on mortality, recent media coverage has increased public awareness on the particular—and long-standing—problem of suicide in correctional facilities. For example, in July 2015, a month prior to the August 2015 release of the BJS report Mortality in Local Jails and State Prisons, 2000–2013, national attention was focused on Waller County, Texas, where Sandra Bland committed suicide while detained at the local jail. The media attention that resulted from that case gave the issue of suicide in correctional facilities new exposure and salience. As the Bland case unfolded, the BJS report provided quantitative context, reporting that suicides, the leading cause of deaths in An expert panel of prison and jail administrators, researchers, and health care professionals identified the following as high-priority needs for ensuring the health and safety of inmates in correctional facilities:

The Economic Impact of Medicaid Expansion on Pennsylvania

A s changes occur in society, fitting the effects of those changes into existing legal structures and practices is not always smooth. When changes are gradual, law and precedent have time to react, using analogies to earlier situations or cases to build and understand how today’s world might differ from the world in which those precedents were set. When changes are sudden, however, thinking through how to address them can be tougher, and large-scale shifts can make it difficult to navigate the present based solely on analogies to the past. Shifts in technology—in which new innovations can produce rapid differences in what is possible—can create these types of challenges. As part of a multiyear research effort sponsored by and supporting the National Institute of Justice, the Priority Criminal Justice Needs Initiative has focused on identifying innovations in technology, policy, and practice that would be beneficial to the U.S. criminal justice sector. To do so, we convened expert panels and held other structured discussions with practitioners from law enforcement, courts, and corrections. During these discussions, practitioners identified changes in technology or new ways of doing things that might save money or enhance performance but also flagged innovations that might threaten the ideals that the criminal justice system is charged with protecting. An example that arose more than once in discussions with court practitioners was virtual presence. Teleconferencing has evolved from an expensive technology transmitting low-quality images to a technology so cheap that it is included as a standard feature in most new mobile communication devices. Today, on higher-end professional systems, a person can appear life size and at high enough resolution that a viewer can read facial expressions and body language. In the future, virtual reality • Panelists convened to craft a research agenda to ensure that advances in technology inside and outside the criminal justice system do not adversely affect the protection of individuals’ constitutional rights and identified a variety of needs for the near and longer terms.