Upload
donald-wood
View
219
Download
0
Tags:
Embed Size (px)
Citation preview
1
CSCD 496Computer Forensics
Lecture 12Laws – Specific
Winter 2010
2
Introduction
• Laws – Specific laws related to Electronic
Crimes• CFFA – Computer Fraud and Abuse Act• Economic Espionage Act • Digital Millennium Copyright Act• Federal Wiretap Act• Patriot Act I
– How some of these relate to privacy• Laws that try to Protect Privacy
3
Background
• Last time ... heard a lawyer speak of you being expert witnesses– Assumption when you testify, know
something about the court system and process
– Also, know about the laws governing digital evidence
4
Overview
• As a digital forensics Practitioner– Why do you need to know the laws?
5
General Electronic Crime Laws
6
CFAA• The first truly comprehensive federal computer
crime statute Computer Fraud and Abuse Act of 1986 (CFAA).
• The act amended Title 18 United States Code Section 1030 to enhance penalties for six types of computer activities: – Unauthorized access of a computer to obtain information
of national secrecy with an intent to injure the United States or give advantage to a foreign nation
– Unauthorized access of a computer to obtain protected financial or credit information
– Unauthorized access into a computer used by the federal government
– Unauthorized interstate or foreign access of a computer system with an intent to defraud
– Unauthorized interstate or foreign access of computer systems that results in at least $1,000 aggregate damage
– Fraudulent trafficking in computer passwords affecting interstate commerce
7
CFAA
• Consequences of law– Made it crime to break into government
computers or financial institutions • Credit card data
– Extended to include all federal interested computers
• Now, included University computers funded by federal research grants
– Penalties of up to 20 years in prison
8
Application of CFAA• Most famous application of this statute was
United States v. Morris in 1989– Robert Tappan Morris, a Cornell University
graduate student who, on November 2, 1988, released a computer "worm" across the Internet computer network
– Worm targeted Unix systems – Didn’t steal or damage computer it infected –
only purpose was to break into as many computers as it could
– Morris said it was an experiment that went wrong
– Convicted and had to contribute 400 hours of community service, $10,000 fine and 3 years probation
9
Application of CFAA• Despite successful prosecution in the Morris case and several
other famous computer crime prosecutions (including prosecutions of computer hackers of the Legion of Doom and Masters of Deception), problems continued with the statute. – The most glaring was the omission of what was called
malicious code -- computer viruses
• As a result, in 1992 Congress amended the computer crime statute to punish those who, without the knowledge and authorization of the "persons or entities who own or are responsible for" a computer, bring about the transmission of "a program, information, code, or command to a computer or computer system" with the intent to cause damage to the computer or information in the computer or prevent the use of the system.
• As well as punishing intentional conduct, the amended statute criminalizes those who act with reckless disregard or a substantial and unjustifiable risk of damage or loss, – Would create a civil case for compensatory damages for "any
person who suffers damage or loss by reason of a violation of the section."
10
Application of CFAA
• In addition to addressing intrusions and viruses• Statute prohibits DoS attacks that cause $1,000 or more
damage • CFAA can be used with other laws to bring charges against
an individual
• Yet, all states except Vermont have additional computer crime statutes that extend CFAA
• Many state statutes make it illegal to break into a computer even if no damage was done
• Illegal to alter or destroy data,• Steal services, • Deny another person access or use the computer with
intent to commit a variety of crimes
11
Economic Espionage Act
• Economic Espionage Act– Enacted in 1996 – Theft of trade secrets
• Declared criminal violation
– Prior to this• Corporate spying and stealing of trade
secrets violation of civil law• Now, became criminal to steal trade secrets
– Now• Corporate officials who condone, fund, know
of spying by their employees may be held responsible under this law
• Has to be $100,000 minimum threshold
12
Electronic Theft Act• 1997 – First law to deal with electronic
copyright violations– Authorize criminal fines and incarceration for
people convicted of intentionally distributing copyrighted works over the Internet
– Previous laws• If you did not profit, didn’t face criminal charges• Now, includes anyone who distributes
copyrighted material – even if they don’t charge– Justice department
• This was their response to curtail the growing problem of copyright infringement by electronic means
13
Digital Millennium Copyright Act
• 1998 – One year later – More comprehensive law – DMCA– “Illegal to manufacture, distribute or sell
technology to circumvent copyright protections …”
– Also set limits on liability for those who do try to circumvent copyright protections
14
DMCA
• Specifically …1. Prohibits manufacture, sale or
distribution of code-cracking devices2. Limits ISP’s from copyright
infringement liability3. Higher education institutions are
limited for liability for students and faculty
15
Wiretaps and Privacy
Copyright 2005 - 2009: Hi Tech Criminal Justice, Raymond E. Foster
General Wiretap Rules
• Generally requires both prosecutorial and judicial review
• Wiretaps require probable cause like any search warrant
• Must focus on gaining specific information about a crime– Not just general investigative
information
Copyright 2005 - 2009: Hi Tech Criminal Justice, Raymond E. Foster
General Wiretap Rules• To obtain court order, investigators
must show that the information cannot be obtained in another manner
• Investigators must provide the court with:– Specific offense– Specific place to be tapped– Types of conversations believed to be
overheard
Copyright 2005 - 2009: Hi Tech Criminal Justice, Raymond E. Foster
Legal History of Wiretaps• 1968 Omnibus Crime Control and
Safe Streets Act – Title III known as Federal Wiretap Act– In a nutshell says ... – Electronic surveillance made illegal,
except pursuant to a court order
Precursor to Patriot Act
• Foreign Intelligence Surveillance Act of 1978 (FISA)– Requires approval from the Foreign
Intelligence Surveillance Court for electronic surveillance in national security cases
20
Federal Wiretap Act and ECPA
• 1986, Congress passed Electronic Communication Privacy Act (ECPA) to update Federal Wiretap Act– Considered all form of electronic
communication – telephone, cell phone, computer or other electronic devices
– Law enabled ISP’s to intercept and read suspicious e-mails
– Granted nationwide recording consent to law enforcement officers conducting criminal investigations
– Police can monitor e-mail with assistance from ISP’s.
Legislative Background
• Electronic Communications Privacy Act – Basically .....– Amended Title III protections to cover
most wire and wireless communications– Requires a court order for the use of pen
register and trap and trace devices– Regulates use of roving wiretaps
• Wiretap that follows the target, can still follow if they get a new phone
General Wiretap Rules• Every five days the investigators must
provide the judicial authority with a thorough review of the conversations.
• In addition to five day review, at the end of the tap, the investigator’s must provide both the judicial and prosecutorial authority with a complete review.
• Thirty days after the conclusion of the tap, each person whose conversations were recorded must be notified in writing.
23
ECPA Communications Assistance for Law Enforcement Act of 1994 (CALEA)
• 1994 – Congress expanded ECPA to require Telecommunications Carriers – Assist law enforcement with electronic surveillance– ISP’s reluctant to cooperate in criminal
investigations – concerned about privacy violations– Law provided needed legal protection to
telecommunications companies – Today, all firms in compliance with ECPA– New ISP’s must demonstrate their ability to assist
law enforcement monitoring and surveillance needs prior to getting an operating license
– Note: There are some good things about ECPA and privacy … later
Copyright 2005 - 2009: Hi Tech Criminal Justice, Raymond E. Foster
Pens, Traps and Traces
• In compliance with CALEA, cellular and hard-wired telephone identifying information is now routed to law enforcement via secure TCP/IP connection.
• With Cellular information, the cell site can be known and the target’s general location determined.
Indicates cell Indicates cell receptionreception
Screen Capture provided by Pen-LinkScreen Capture provided by Pen-Link™™
25
USA Patriot Act
• Following 9/11 attack in 2001
– 6 weeks after attack, very little debate from Congress – passed USA Patriot Act
– Much easier to monitor and intercept communication from suspected terrorists or people having affiliations with terrorists
– Now, needed only a letter from law enforcement instead of court order and affidavit documenting suspicious activities
26
USA Patriot Act (PA)
• Act allowed real-time monitoring of communications and prohibited ISP’s from telling about the investigation
• Allowed warrant-less searches of homes and businesses instances involving suspected terrorists– PA makes it a federal crime to not
cooperate in these investigations• Prohibited business owners and others
from consulting their own legal counsel– This has since been restored – considered it a
violation of 1st Amendment rights to have legal counsel during investigation
27
USA Patriot Act (PA)• Congress did require an investigative
review in 2006 – 5 years after 9/11• What happened?
– Read about it http://www.cnn.com/2006/POLITICS/03/07/
patriot.act/
– It was voted in permanently in 2006
• It was up for review again in 2009– Obama administration elected to continue
with the main provisions of Patriot ACThttp://www.washingtontimes.com/news/2009/
sep/16/obama-seeks-patriot-act-extensions/
28
Privacy Provisions
29
Privacy
• Does technology complicate privacy?– Privacy is not defined the same way by
everyone• Has been defined as
–Right to be free from government intrusion
–Right to be free from others prying into our private lives
– Government Intrusions• Protected by constitutional interpretation
– Individual Intrusions• Protected by common law
30
Privacy
• From the perspective of US Law– Direct correlation between what
technology makes possible and what our privacy expectations are
– Definition of privacy is continually evolving
• What is private today and subject to protection under unreasonable search and seizure via the 4th amendment may no longer be private and exempt from such protection tomorrow
31
Privacy
• Number of Federal Statutes aimed at preserving privacy– ECPA – Electronic Communications
Privacy Act• Regulates interception of electronic
communication by both government and private individuals
– Privacy Act of 1974• Impose limits on the collection and use of
personal information by federal agencies
32
Privacy
• Federal Statutes– Family Educational Rights and Privacy
Act• Permits students (and Parents of Minor
students) to examine and challenge the accuracy of school records
– Fair Credit Reporting Act• Regulates the collection and use of personal
data by credit reporting agencies
33
Privacy
• Statutes– Federal Right to Financial Privacy Act 1978
• Limits ability of finance institution to disclose customer information to agencies of the federal government
• Right to Privacy• Protected by common law and statutes• “privacy” doesn’t appear in the constitution• Right to privacy separate body of law
developed over many years through interpretation and analysis of the 4th amendment
• Prohibits “unreasonable” search and seizure
34
Privacy
• Unreasonable search and seizure– What is unreasonable?
• Made by government without a warrant• Violates a person’s expectation of privacy
– Were they trying to keep something private– Or, is it in full view and not hidden
• And, is the expectation of privacy one that society believes is reasonable
• The above two arguments are used as a test for privacy by the courts
35
Privacy
• Cases– Katz vs. United States
• Had a conversation about gambling in a public phone booth
• Federal agents listened to his conversation through an electronic listening device pasted on the outside of the phone booth
• Was that illegal under the 4th?
36
Privacy
• Katz vs. the US• Actually, it was• Ruled that Katz had an expectation of
privacy since he had shut the door and was in an enclosed booth
• They had violated the 4th amendment• What about Cell phones?
37
Privacy• Case
– Kyllo vs. US – 2001• Suspected of growing Marijuana in his home• Without obtaining a warrant, federal agents used a
thermal imager to scan Kyllo’s triplex apartment from the seat of a car
• Imager showed that the roof and side wall of the garage was “hot” compared to the rest of the structure
• Agents concluded that Kyllo was using Halide lights to grow marijuana
• Based on these results plus Kyllo’s high energy bills and tip from an informer, agents got a warrant to search Kyllo’s home
• Found an indoor Marijuana operation in the home• Kyllo was indicted on one count of manufacturing
marijuana
38
Privacy
• Case – Kyllo vs. US – 2001
• Kyllo tried to suppress the evidence obtained by the thermal imaging
– Said that a warrant should have been used to do the imaging
• Ninth Circuit Court of Appeals held that no warrant was needed for the thermal imaging
– Kyllo had not exhibited a reasonable expectation of privacy because he had made not attempt to conceal the heat escaping from his home
– Even if he did, the thermal imager did not expose details of his life, just “hot spots” on his house
39
Privacy
• Case – Kyllo vs. US – 2001
• Supreme Court reversed the decision– Court noted that it is true that warrantless
surveillance is generally legal and that previous holdings say that visual observation is simply not a search and thus not subject to 4th amendment provisions,
– But, critical issue in this case was:...what limits there are upon the power of
technology to shrink the realm of guaranteed privacy
– Found that the thermal imager was a device not in general public use and it exposed details of activities in the home
40
Privacy
• Other Electronic Communication– ECPA
• Prohibits anyone – not just the government from unlawfully accessing or intercepting electronic communications
• Says that to obtain authorization to intercept transmissions, law enforcement must obtain a court order
• Makes it harder to get authorization to intercept electronic communication
• Search warrant doesn’t count as a court order• My Comments
– Of course the Patriot Act invalidated a lot of these provisions
41
Privacy
• ECPA– Stored communication
• Can be obtained with a search warrant • Belief is that intercepting transmission is
potentially a greater invasion of privacy than stored communication
• Stored communication – More targeted– Less chance of obtaining something unrelated
and private – Interception, more random and could overhear
something that wasn’t desired to be made public
42
Privacy
• ECPA– It is argued that under certain conditions
• Prior consent of one of the participants in a communication
• Organization can search employees communication
– Many companies have policies that require employees to sign an agreement to allow their personal communication to be monitored prior to allowing them to use e-mail or the company network
43
Conclusion• Laws are constantly evolving in
response to developing technology– Issues of Jurisdiction, Legality
• Become more vague when
• Technology makes privacy much harder to define
• Since we are “technologists”• Need to be aware of the latest laws that
affect your rights privately and as a professional
• We should be providing input on laws that we believe violate our rights
• Patriot Act for example
44
Resource URL's• Electronic Privacy Information Center:
– www.epic.org/ • Electronic Freedom Foundation:
– www.eff.org/
45
Resources
Digital Evidence and Computer Crimeby Eoghan Casey
Understanding and Managing Cybercrimeby Samuel C. McQuade III
46
End
• Look for Lab On your own