Unit-III Violent Crime and Digital Evidence Prof. Pansare R.B. Department of Computer engineering SND College of Engineering & RC,Yeola

CONTENTS Violent Crime and Digital Evidence, Digital Evidence as Alibi, Gender Offenders on the Internet, Computer Intrusions.

Violent Crime Challenges Role of Computers with Example Role of Mobile Devices with Example Role of Personal Computers Role of Private Networks Role of Intents & Motive Processing the Digital crime Scene

Challenges Violent crimes are challenging to investigate the severe behavior that is involved, the complexity of formative events and relationships. That is to say, these types of crimes do not happen in a vacuum. CASE EXAMPLE (MARYLAND, 2010) After arresting Jason Scott for allegedly killing a mother and daughter, Delores and Ebony Dewitt, police searched his home and found various sources of digital evidence. The digital evidence included a memory stick with photographs

The Role OF Computers IN Violent CRIME )Cybertrails Computers may contain useful information about the Internet activities of individuals involved in a violent crime. For instance, communications between the victim and offender, especially in cases of intimate homicide. the planning and commission of the crime. Data from Internet service providers used by the victim or suspect can also help determine their activities around the time of the crime, their whereabouts, and their identity. serial murderer Maury Travis was tracked down using the IP address he used when accessing an online map Web site.

CASE EXAMPLE (NEW HAMPSHIRE, 2001) Two teenagers, stabbed and killed professors in their home.,had purchased the murder weapons, SOG Seal 2000 knives, on the Internet. Police tracked purchases of such knives and interviewed the teen- agers but did not initially suspect them. After being interviewed by police, the teenagers contacted each other over Instant Messenger and agreed to flew to California. Police were ultimately able to link the murder weapon to teenagers, and apprehended them .Both received a life sentenceand 25 years to life.

Copyright © 2011 Academic Press Inc. Figure 1.1 FIGURE 10.1 Diagram depicting potential sources of digital evidence linking the victim of a violent crime with the offender and crime scenes. Copyright © 2011 Academic Press Inc.

THE ROLE OF MOBILE DEVICESIN VIOLENT CRIME Mobile devices may contain information about communications audio or video recordings relating to an offense. location of victims and suspects at key times. In one homicide case, Joe O’Reilly claimed that he was at work when his wife was killed but his cell phone location showed him traveling from work to the scene of the crime and then returning to work. His location and the direction he was moving were confirmed by digital evidence obtained from CCTV cameras.

THE ROLE OF PERSONAL COMPUTERS IN VIOLENT CRIME A victim’s computer may contain a diary frequently retain sent and received e-mails that offer a unique view into his/her personal life. can include evidence of criminal activity, and clandestine relationships that even friends and family do not know about. Digital evidence may be useful for locating a missing person when it contains clues of whom she communicated with and where she might have gone.

THE ROLE OF PRIVATE NETWORKS IN VIOLENT CRIME privately owned networks can also be a rich source of information Information gathered in digital form by other businesses such as banks, telecommunication providers, credit card companies, and electronic toll collection systems can reveal a significant amount about an individual’s whereabouts and activities. CASE EXAMPLE (CHESHIRE, UNITED KINGDOM) In the U.K. case involving Dr. Harold Shipman, changes he made to computerized medical records on his medical office computer system were instrumental in convicting him of killing hundreds of patients. Shipman used to maintain patient records, investiga- tors found that the program kept an audit trail, recording changes made to patient records. This audit trail indicated that Shipman had lied about patients’ symptoms and made backdated modifications to records to conceal the mur- ders. Had the investigators accepted the patient records without digging deeper into their authenticity, they would have missed this key piece of evidence about the cover- up attempt.

THE ROLE OF INTENT AND MOTIVE IN VIOLENT CRIME In addition to providing concrete leads, a murderer’s computer or mobile device may disprove offender statements, show his intent to commit a crime, and uncover evidence of staging such as a fake suicide note created after the victim’s death. For instance, Reverend William Guthrie was sentenced to life in prison partly on the basis of digital evidence showing that he used a computer to search online for ways to kill his wife and to fabricate a suicide note sev- eral months after her death

PROCESSING THE DIGITAL CRIME SCENE wear nitrile gloves to prevent their fingerprints from transferring onto objects and to protect their skin from hazardous substances Authorization(searches with/without a warrant.) Preparation: Make a Plan, Follow the Plan Crime Scene Survey and Documentation (Overlooked Evidence :During an internal investigation in a large corporation, one server that had been preserved on a rack of a dozen other systems was central to the investigation. The server had been put in place without the knowledge of upper management and was being used against corporate policy to monitor online activities of various employees.) Enterprise Networks as Evidence to collect the content of network activities and telephone conversations care must be taken not to put too much trust in those who run the systems for a number of reasons, including the following: They may not have a forensic background, leading to lost or tainted evidence. They have interest in protecting the organization from liability or negative press They could be a friend of the victim and try to protect the victim’s data. They may be the offender.

INVESTIGATIVE RECONSTRUCTION Pulling all evidence together and letting it speak for itself. Consider alternative explanations for a given piece of evidence rather than jumping to a conclusion on the basis of personal bias or past experience.

INVESTIGATIVE RECONSTRUCTION Offender Behavior to look for behaviors that leave digital traces. Victimology Victimology is the assessment of the victim as they relate to the offender, the crime scene, the incident, and the criminal justice system. Crime Scene Characteristics crime scenes fall into two categories— Primary: where the violent offense occurred and Secondary: where the victim was abducted and where the offender discarded clothes, weapons, and digital devices. Computers and mobile devices are treated as secondary crime scenes in violent crime investigations

Digital Evidence as Alibi What is Alibi ? Investigating an Alibi

What is Alibi? An alibi is a form of defense used in criminal procedure wherein the accused attempts to prove that he or she was in some other place at the time the alleged offense was committed.

Alibi Key pieces are: time and location Jerry Durado was found guilty of killing his parents despite his claim that he was at work 300 miles away. A forensic analysis showed that only thing that happened in his computer at work was a virus scan. Telephone logs, credit card records, internet activities, etc. Computer times and IP address are used as Alibi. Keep in mind these can be manipulated creating a false alibi.

Investigating an alibi Establish reliability of digital evidence DHCP records will show assigned IP addresses. Can IP address be changed by the user? Can the time be changed by the user? A suspect claimed he was at home, doing nothing other than sending an email to his friend. The friend shared the email, and the header revealed that was not sent from the suspects home. The date and time did not match, and the email was forged. His own computer showed evidence of attempts at forging to learn how to do it.

Online Child Pornography and Sex Offenders 22.09.2018

Overview Five sections: Katie’s story Definitions Child-pornography and online sex offenders Possible remedies 22.09.2018

Katie’s story Social Responsibility Moral panic 22.09.2018

Definitions Child pornography depicts children in sexual context. By definition, children cannot consent to sex. It is abusive and coercive. Every depiction of sexual intercourse with real children is considered to be molestation, a criminal act. 22.09.2018

Definitions Online child sex offenders are people who watch, download, produce, store and transmit images of children in a sexual context. Online child sex offenders utilise the Internet for this purpose. The term ‘paedophilia’ is a clinical term and is used to refer to a psychosexual disorder involving a sexual preference for children. 22.09.2018

Online Behavior: Where Parents and Teens Agree 81% of parents and 79% of teens agree that kids are not as careful as they should be about the information they give out online 62% of parents and 62% of teens agree that kids do things online that they wouldn’t want their parents to know about Overall, most parents believe that the internet is a good thing for their children

Child Pornography Pornographers are always among the first to recognize and exploit the potential of each new wave of communication technology, from the printing press and early photography to film and video, and now the Internet Most states prohibit by their criminal law the production, promotion, sale, exhibition, or distribution of photographs or videos of children engaged in any sexual activity 22.09.2018

Child Pornography The Internet features of accessibility, privacy and low cost serve to encourage some offences. Child pornography is often used by offenders to groom children by “normalizing” sexual activity with children and breaking down inhibitions, or to blackmail a child into desired behaviour by threatening to expose their use of pornography. The saturation of the internet with such material may serve to “normalize” this behaviour and probably makes it easier to objectify children as sexual artifacts. Pornography is also thought to reinforce a person’s sexual attraction to children 22.09.2018

Child Pornography Social-networking sites have been shown to attract sexual predators looking to take advantage of naïve young people. Launched in 2004, MySpace has swiftly become one of the biggest hits in the history of the Internet. Crimes as serious as murder and rape have been linked to teens using the site. There is a strong link between those who collect images and those who molest children. The following chart shows who are the offenders: 22.09.2018

22.09.2018

The Offenders 77% of the offenders were known to the child. These were his/her parents, their partners, relatives, babysitters and neighbours. 12% were offenders who enticed children via the Internet. 5% (others) were unknown to the children. 6% invited/initiated/self-inflicted the offence. 22.09.2018

Identity Child pornographers conceal their true identity by means of proxies, “false flag” addresses, the use of which means that the host site will not be able to identify a visitor’s true IP. They (the careful ones) will never use their own credit card to pay for photos or videos. Some users succeed in hacking into a pay server, stealing another person’s credit card, but this route is only for the truly ingenious 22.09.2018

How Child Pornographers Work? A person has a collection of several thousand child porn images He likes to share them First, he obtains a proxy that conceals his name and location and acquires a new e-mail account under a false name from an anonymous provider, likely in a third world nation: both are easy to do. With these bogus credentials, he opens an account that permits him to set up a home page on an innocent and aboveboard public server such as angelfire.com 22.09.2018

How Child Pornographers Work? Unknown to the provider, the person loads how many photos he wants The site is of no use to anyone as yet, in that nobody is likely to stumble across it by accident Our generous child-pornographer used to announce the posting of the series on the Maestro board or one of its counterparts, where the message is read and acknowledged gratefully by other “loli fans” Duly alerted, consumers then flock to the site advertised, which may be based in any of twenty countries, and then download the pictures. The images will exist at that site only for a few hours before they are removed and the site ceases to exist 22.09.2018

How Child Pornographers Work? In the past, the best way to discover child-pornographers activity was by discerning a site that suddenly attracted thousands of hits within a few hours Sometimes money changes hands and videos are sold, but many sites that demand payment for access are bogus, and anyone gullible enough to pay will, if he is lucky, just lose the price of admission; if he is less fortunate, he will have earned a visit from the police. 22.09.2018

How Child Pornographers Work? In 2009, Swiss police uncovered an Internet child pornography network spanning 78 countries and involving at least 2,000 IP internet addresses. An inquiry was launched after a tip-off from Interpol about a Swiss website being used as a forum for illegal child pornography films. The site was officially devoted to hip hop music but was used to access videos of child pornography via secret codes. 22.09.2018

How Child Pornographers Work? The authorities had been monitoring the website for some time. Dozens of arrests and several convictions have been made as a result of the investigation, which began in May 2008. The site's designer was apparently not aware what it was being used for and was cleared of any involvement in the ring. 22.09.2018

Collections The vast majority of people who post or distribute pictures do so out of non-economic motives The sense for completion or perfection is particularly marked in child porn collecting. Hobbyists seek unbroken series of the various photo shoots such as KG or Tiny Americans, and they pride themselves on their achievement in seeking out and amassing items. 22.09.2018

Rings Sex offenders operate in clandestine methods to hide their illegal activities. They operate via closed chatrooms and hidden websites, sometimes hijacked for their purposes, sometimes established for a brief period of time. They operate in rings that cross continents. Always under fear that the ring might be compromised. 22.09.2018

Encryption The careful child-pornographers use encryption when they exchange images Without the key, it is very difficult to decode the image Encryption is the best friend of all people involved in illegal activities: Child-pornographers, terrorists and criminals. 22.09.2018

Remedies Education Parental Supervision Physical-Geographical Control (at home, in libraries) Filters Denying Legitimacy ISPs Liability 22.09.2018

Remedies Need for more youth education International cooperation between governments as well as between governments and Internet Service Providers. 22.09.2018

Remedies Business Ban International Cooperation: Working Group on Internet Governance Legislation and Precedents Monitoring Websites Removing Criminal Websites CleaNet 22.09.2018

Remedies Introducing a different rationale: Instead of free highway, social responsibility 22.09.2018

Computer Intrusion

The Threats of the Internet Global solution for global problem Individual/ISPs State Who’s Responsible? Business ban Filters 22.09.2018