Hans-Leo Teulings & Heidi Harralson MovAlyzeR Software in Forensic Document Examination A Hands-on Workshop to assist FDEs in Understanding Point-Of-Sale Signatures Hans-Leo Teulings & Heidi Harralson AFDE Pre-Symposium Workshop in conjunction with NeuroScript, LLC: MovAlyzeR Software in Forensic Document Examination Wednesday, October 17, 2012, 8am-5pm Embassy Suites, 4415 East Paradise Village Parkway, Scottsdale, Arizona,USA Spectrum Forensic Int’l Tucson, AZ, USA Tempe, AZ, USA

Why Use MovAlyzeR? Relevance of this course for FDEs Biometric analysis of e-signatures Capturing electronic comparison samples Simulation techniques using digital technology Static analysis of e-signatures Using a methodological approach in analyzing e-signatures 2

Analyzing Data Online studies comparing natural and simulated handwriting effects Van Gemmert & Van Galen (1996) Thomassen & Van Galen (1997) Sita & Rogers (1999) Harralson, Teulings & Miller (2008) 3

4

5

6

7

E-Signature Methodological Analysis Types Digital Electronic Static 8 Method for the Forensic Analysis of Electronic Handwritten Signatures 1. Digital Cryptographic Signature Digital cryptographic signature captured with biometric or static handwriting signature. See Biometric or Static Signature. Non-handwriting evidence. Refer to digital evidence expert. 2. Biometric Handwritten Signature Biometric data available. Evaluate data and capture method. Reliable data and capture method. Evaluate handwriting features captured. Individualizing and reliable handwriting features captured. Comparable comparison signatures (biometric comparison signatures). Unqualified opinions possible. Only static signatures available for comparison. Qualified or no conclusion opinions. Insufficient and unreliable handwriting features captured. No conclusion. Unreliable data and/or capture method. No conclusion. No biometric data available See Static Signature. 3. Static Handwritten Signature Evaluate capture method and resolution quality. Reliable capture method and high resolution quality. Comparable comparison signatures (similar capture method). Qualified opinions possible. No comparable signatures available. No conclusion. Unknown/unreliable capture method and poor resolution quality. No conclusion.

Digital Signature Digital Signature. A mathematical algorithm comprised of a private key and public key that is used for authenticating an electronic document. Digital signatures are mathematical data, not handwritten signatures. “Digital” and “Electronic” terms are frequently used interchangeably. 9

Terminology Hash Function Private Key Public Key Public-Key Infrastructure (PKI) 10

Digital Signature 11

Digital Signature Analysis Digital cryptographic signature sometimes captured with biometric or static handwritten signature Digital cryptograph is non-handwriting evidence Refer to digital evidence specialist 12

Digital / Electronic Signatures Global and National Commerce Act. (2000) SOFTPRO Penflow Biometric Signature ID Topaz Cyber-SIGN DocuSign, EchoSign e-signing. SignPlus Adobe Acrobat digital signature 13 Electronic Digital

Electronic Signature Electronic Signature. Handwritten signature that is captured on an electronic device using a stylus and digital tablet, or a digital pen. The law does not distinguish between a digital algorithm signature and a biometric signature. They are both considered electronic signatures even though they are different “signing” processes (also E- signature). 14

Terminology Biometric Digital Ink Offline Online Pen Computing Static Temporal Wet Ink 15

Static Electronic Signature Resolution and capture method Are resolution and capture method reliable? Static online versus digitized offline Font-based signature? Comparison samples Are standards comparable? Signing conditions 16

Signs Indicative of a Static E-Signature Reduction of signature size (size out of proportion with document) Signature does not interact with signing “environment” Awkward placement Pixelation 17

18 Font-Based E-Signatures

Digital Representations Gray level Binarized Skeletonized Ordered Equidistant Constant Frequency

Biometric Signature Biometric signature Is biometric data available? Data and capture method Are the data and capture method reliable?  Linearity tests of the tablet  Equidistant sample points (degraded data…only the sequence of stroke and size can be analyzed) 20

21 Comparison of raw data (top) with resampled data showing equidistant sample points (bottom)

22 Image of traced (unfiltered) strokes and digitally manipulated (filtered) strokes.

Data and Capture Method Data storage and transmission Acquisition Reliability of pressure, pen-tip, pen-tilt is hardware-dependent 23

Data and Capture Method Data quality (Hertz rate) Hertz threshold for reliable analysis 100 Hz minimum MicroSoft recommends 125 Hz Experimental studies use 200 Hz 24

Analysis Handwriting features Are individualizing and reliable handwriting features captured? Comparison samples Are standards comparable? Biometric v. Static comparison samples Signing conditions 25

Reliable Handwriting Features Horizontal position Vertical position Pressure measures Velocity measures Acceleration measures Total time Pen-down samples Pen azimuth Pen elevation Radius of curvature Length 26

Limitations Azimuth, altitude had high standard deviations Curve radius useful for detecting random forgeries, but less for skilled forgeries Pressure not very consistent within natural handwriting Large variation in pressure between samples not a good indicator of forgery Similar pressure pattern indicative of genuine writing 27

Forming Opinions Just as in “traditional” signature cases, each handwriting feature needs to be evaluated Individually Collectively Evaluate quality, similarity, and number of comparison samples Evaluate reliability of data In most cases, it may be difficult to form conclusive opinions 28

Practical Experiment 7 known, pen-ink signatures 3 known e-signatures captured on Topaz tablet with stylus 7 questioned e-signatures 29

Equivalent MovAlyzeR Features Horizontal position Vertical position Pressure measures Velocity measures Acceleration measures Total time Pen-down samples Pen azimuth Pen elevation Radius of curvature Length  X axis  Y axis  Z axis  Abs Velocity; Vertical Velocity  Vertical Acceleration (not abs)  Duration  Segmentation Analysis (adv)  Only Wacom tablets  Pen tilt (only Wacom tablets)  Curvature (external app)  Roadlength, Absolute Size, Horizontal/Vertical Size 30 Equivalent MovAlyzeR Feature

MovAlyzeR Features Absolute velocity v. time Y velocity v. time Y acceleration v. time Velocity spectrum Duration 31

32 X versus Y

33 Absolute velocity

34 X versus Y and Absolute velocity

35 Y (vertical) velocity v. time

36 Y (vertical) acceleration v. time

37 Velocity Spectrum

References Alonso-Fernandez, F., Fierrez-Aguilar, J., & Ortega-Garcia, J. (2005). Sensor interoperability and fusion in signature verification: A case study using Tablet PC. Advances in Biometric Person Authentication, Lecture Notes in Computer Science, 3781, Lei, H., & Govindaraju, V. (2005). A comparative study on the consistency of features in on-line signature verification. Pattern Recognition Letters, 26(15), Liwicki, M. (2012). Automatic signature verification: In-depth investigation of novel features and different models. Journal of Forensic Document Examination, 22, Richiardi, J., Ketabdar, H., & Drygajlo, A. (2005). Local and global feature selection for on-line signature verification. In International Conference on Document Analysis and Recognition, 2, 29 August – 1 September, (pp ). Tariq, S., Sarwar, S., & Hussain, W. (2011). Classification of features into strong and weak features for an intelligent online signature verification system. In Proceedings of the First International Workshop on Automated Forensic Handwriting Analysis (AFHA), September 2011, Beijing, China. Zhang, Y., Shi, G., & Yang, J. (2009). HMM-based online recognition of handwritten chemical symbols. In Tenth International Conference on Document Analysis and Recognition (ICDAR), July (pp ). 38