1. CSCD 496 Computer Forensics
Lecture 12
Laws – Specific
Winter 2010

2. Introduction Laws Specific laws related to Electronic Crimes
CFFA – Computer Fraud and Abuse Act
Economic Espionage Act
Digital Millennium Copyright Act
Federal Wiretap Act
Patriot Act I
How some of these relate to privacy
Laws that try to Protect Privacy

3. Background
Last time ... heard a lawyer speak of you being expert witnesses
Assumption when you testify, know something about the court system and process
Also, know about the laws governing digital evidence

4. Overview As a digital forensics Practitioner
Why do you need to know the laws?

5. General Electronic Crime Laws

6. CFAA
The first truly comprehensive federal computer crime statute Computer Fraud and Abuse Act of 1986 (CFAA).
The act amended Title 18 United States Code Section to enhance penalties for six types of computer activities:
Unauthorized access of a computer to obtain information of national secrecy with an intent to injure the United States or give advantage to a foreign nation
Unauthorized access of a computer to obtain protected financial or credit information
Unauthorized access into a computer used by the federal government
Unauthorized interstate or foreign access of a computer system with an intent to defraud
Unauthorized interstate or foreign access of computer systems that results in at least $1,000 aggregate damage
Fraudulent trafficking in computer passwords affecting interstate commerce

7. CFAA Consequences of law
Made it crime to break into government computers or financial institutions
Credit card data
Extended to include all federal interested computers
Now, included University computers funded by federal research grants
Penalties of up to 20 years in prison

8. Application of CFAA
Most famous application of this statute was United States v. Morris in 1989
Robert Tappan Morris, a Cornell University graduate student who, on November 2, 1988, released a computer "worm" across the Internet computer network
Worm targeted Unix systems
Didn’t steal or damage computer it infected – only purpose was to break into as many computers as it could
Morris said it was an experiment that went wrong
Convicted and had to contribute 400 hours of community service, $10,000 fine and 3 years probation

9. Application of CFAA
Despite successful prosecution in the Morris case and several other famous computer crime prosecutions (including prosecutions of computer hackers of the Legion of Doom and Masters of Deception), problems continued with the statute.
The most glaring was the omission of what was called malicious code -- computer viruses
As a result, in 1992 Congress amended the computer crime statute to punish those who, without the knowledge and authorization of the "persons or entities who own or are responsible for" a computer, bring about the transmission of "a program, information, code, or command to a computer or computer system" with the intent to cause damage to the computer or information in the computer or prevent the use of the system.
As well as punishing intentional conduct, the amended statute criminalizes those who act with reckless disregard or a substantial and unjustifiable risk of damage or loss,
Would create a civil case for compensatory damages for "any person who suffers damage or loss by reason of a violation of the section."

10. Application of CFAA In addition to addressing intrusions and viruses
Statute prohibits DoS attacks that cause $1,000 or more damage
CFAA can be used with other laws to bring charges against an individual
Yet, all states except Vermont have additional computer crime statutes that extend CFAA
Many state statutes make it illegal to break into a computer even if no damage was done
Illegal to alter or destroy data,
Steal services,
Deny another person access or use the computer with intent to commit a variety of crimes

11. Economic Espionage Act
Enacted in 1996 – Theft of trade secrets
Declared criminal violation
Prior to this
Corporate spying and stealing of trade secrets violation of civil law
Now, became criminal to steal trade secrets
Now
Corporate officials who condone, fund, know of spying by their employees may be held responsible under this law
Has to be $100,000 minimum threshold

12. Electronic Theft Act
1997 – First law to deal with electronic copyright violations
Authorize criminal fines and incarceration for people convicted of intentionally distributing copyrighted works over the Internet
Previous laws
If you did not profit, didn’t face criminal charges
Now, includes anyone who distributes copyrighted material – even if they don’t charge
Justice department
This was their response to curtail the growing problem of copyright infringement by electronic means

13. Digital Millennium Copyright Act
1998 – One year later – More comprehensive law – DMCA
“Illegal to manufacture, distribute or sell technology to circumvent copyright protections …”
Also set limits on liability for those who do try to circumvent copyright protections

14. DMCA
Specifically …
1. Prohibits manufacture, sale or distribution of code-cracking devices
2. Limits ISP’s from copyright infringement liability
3. Higher education institutions are limited for liability for students and faculty

15. Wiretaps and Privacy

16. Copyright 2005 - 2009: Hi Tech Criminal Justice, Raymond E. Foster
General Wiretap Rules
Generally requires both prosecutorial and judicial review
Wiretaps require probable cause like any search warrant
Must focus on gaining specific information about a crime
Not just general investigative information
Copyright : Hi Tech Criminal Justice, Raymond E. Foster

17. Copyright 2005 - 2009: Hi Tech Criminal Justice, Raymond E. Foster
General Wiretap Rules
To obtain court order, investigators must show that the information cannot be obtained in another manner
Investigators must provide the court with:
Specific offense
Specific place to be tapped
Types of conversations believed to be overheard
Copyright : Hi Tech Criminal Justice, Raymond E. Foster

18. Legal History of Wiretaps
1968 Omnibus Crime Control and Safe Streets Act
Title III known as Federal Wiretap Act
In a nutshell says ...
Electronic surveillance made illegal, except pursuant to a court order
Copyright : Hi Tech Criminal Justice, Raymond E. Foster

19. Precursor to Patriot Act
Foreign Intelligence Surveillance Act of (FISA)‏
Requires approval from the Foreign Intelligence Surveillance Court for electronic surveillance in national security cases

20. Federal Wiretap Act and ECPA
1986, Congress passed Electronic Communication Privacy Act (ECPA) to update Federal Wiretap Act
Considered all form of electronic communication – telephone, cell phone, computer or other electronic devices
Law enabled ISP’s to intercept and read suspicious e- mails
Granted nationwide recording consent to law enforcement officers conducting criminal investigations
Police can monitor with assistance from ISP’s.

21. Legislative Background
Electronic Communications Privacy Act
Basically .....
Amended Title III protections to cover most wire and wireless communications
Requires a court order for the use of pen register and trap and trace devices
Regulates use of roving wiretaps
Wiretap that follows the target, can still follow if they get a new phone

22. General Wiretap Rules
Every five days the investigators must provide the judicial authority with a thorough review of the conversations.
In addition to five day review, at the end of the tap, the investigator’s must provide both the judicial and prosecutorial authority with a complete review.
Thirty days after the conclusion of the tap, each person whose conversations were recorded must be notified in writing.

23. ECPA Communications Assistance for Law Enforcement Act of 1994 (CALEA)‏
1994 – Congress expanded ECPA to require Telecommunications Carriers
Assist law enforcement with electronic surveillance
ISP’s reluctant to cooperate in criminal investigations – concerned about privacy violations
Law provided needed legal protection to telecommunications companies
Today, all firms in compliance with ECPA
New ISP’s must demonstrate their ability to assist law enforcement monitoring and surveillance needs prior to getting an operating license
Note: There are some good things about ECPA and privacy … later

24. Copyright 2005 - 2009: Hi Tech Criminal Justice, Raymond E. Foster
Pens, Traps and Traces
In compliance with CALEA, cellular and hard-wired telephone identifying information is now routed to law enforcement via secure TCP/IP connection.
With Cellular information, the cell site can be known and the target’s general location determined.
Indicates cell reception
Screen Capture provided by Pen-Link™
Copyright : Hi Tech Criminal Justice, Raymond E. Foster

25. USA Patriot Act Following 9/11 attack in 2001
6 weeks after attack, very little debate from Congress – passed USA Patriot Act
Much easier to monitor and intercept communication from suspected terrorists or people having affiliations with terrorists
Now, needed only a letter from law enforcement instead of court order and affidavit documenting suspicious activities

26. USA Patriot Act (PA)‏
Act allowed real-time monitoring of communications and prohibited ISP’s from telling about the investigation
Allowed warrant-less searches of homes and businesses instances involving suspected terrorists
PA makes it a federal crime to not cooperate in these investigations
Prohibited business owners and others from consulting their own legal counsel
This has since been restored – considered it a violation of 1st Amendment rights to have legal counsel during investigation

27. USA Patriot Act (PA)‏
Congress did require an investigative review in 2006 – 5 years after 9/11
What happened?
Read about it
It was voted in permanently in 2006
It was up for review again in 2009
Obama administration elected to continue with the main provisions of Patriot ACT
obama-seeks-patriot-act-extensions/

28. Privacy Provisions

29. Privacy Does technology complicate privacy?
Privacy is not defined the same way by everyone
Has been defined as
Right to be free from government intrusion
Right to be free from others prying into our private lives
Government Intrusions
Protected by constitutional interpretation
Individual Intrusions
Protected by common law

30. Privacy From the perspective of US Law
Direct correlation between what technology makes possible and what our privacy expectations are
Definition of privacy is continually evolving
What is private today and subject to protection under unreasonable search and seizure via the 4th amendment may no longer be private and exempt from such protection tomorrow

31. Privacy Number of Federal Statutes aimed at preserving privacy
ECPA – Electronic Communications Privacy Act
Regulates interception of electronic communication by both government and private individuals
Privacy Act of 1974
Impose limits on the collection and use of personal information by federal agencies

32. Privacy Federal Statutes Family Educational Rights and Privacy Act
Permits students (and Parents of Minor students) to examine and challenge the accuracy of school records
Fair Credit Reporting Act
Regulates the collection and use of personal data by credit reporting agencies

33. Privacy Statutes Right to Privacy
Federal Right to Financial Privacy Act 1978
Limits ability of finance institution to disclose customer information to agencies of the federal government
Right to Privacy
Protected by common law and statutes
“privacy” doesn’t appear in the constitution
Right to privacy separate body of law developed over many years through interpretation and analysis of the 4th amendment
Prohibits “unreasonable” search and seizure

34. Privacy Unreasonable search and seizure What is unreasonable?
Made by government without a warrant
Violates a person’s expectation of privacy
Were they trying to keep something private
Or, is it in full view and not hidden
And, is the expectation of privacy one that society believes is reasonable
The above two arguments are used as a test for privacy by the courts

35. Privacy Cases Katz vs. United States
Had a conversation about gambling in a public phone booth
Federal agents listened to his conversation through an electronic listening device pasted on the outside of the phone booth
Was that illegal under the 4th?

36. Privacy Katz vs. the US Actually, it was
Ruled that Katz had an expectation of privacy since he had shut the door and was in an enclosed booth
They had violated the 4th amendment
What about Cell phones?

37. Privacy Case Kyllo vs. US – 2001
Suspected of growing Marijuana in his home
Without obtaining a warrant, federal agents used a thermal imager to scan Kyllo’s triplex apartment from the seat of a car
Imager showed that the roof and side wall of the garage was “hot” compared to the rest of the structure
Agents concluded that Kyllo was using Halide lights to grow marijuana
Based on these results plus Kyllo’s high energy bills and tip from an informer, agents got a warrant to search Kyllo’s home
Found an indoor Marijuana operation in the home
Kyllo was indicted on one count of manufacturing marijuana

38. Privacy Case Kyllo vs. US – 2001
Kyllo tried to suppress the evidence obtained by the thermal imaging
Said that a warrant should have been used to do the imaging
Ninth Circuit Court of Appeals held that no warrant was needed for the thermal imaging
Kyllo had not exhibited a reasonable expectation of privacy because he had made not attempt to conceal the heat escaping from his home
Even if he did, the thermal imager did not expose details of his life, just “hot spots” on his house

39. Privacy Case Kyllo vs. US – 2001 Supreme Court reversed the decision
Court noted that it is true that warrantless surveillance is generally legal and that previous holdings say that visual observation is simply not a search and thus not subject to 4th amendment provisions,
But, critical issue in this case was:
...what limits there are upon the power of technology to shrink the realm of guaranteed privacy
Found that the thermal imager was a device not in general public use and it exposed details of activities in the home

40. Privacy Other Electronic Communication ECPA
Prohibits anyone – not just the government from unlawfully accessing or intercepting electronic communications
Says that to obtain authorization to intercept transmissions, law enforcement must obtain a court order
Makes it harder to get authorization to intercept electronic communication
Search warrant doesn’t count as a court order
My Comments
Of course the Patriot Act invalidated a lot of these provisions

41. Privacy ECPA Stored communication
Can be obtained with a search warrant
Belief is that intercepting transmission is potentially a greater invasion of privacy than stored communication
More targeted
Less chance of obtaining something unrelated and private
Interception, more random and could overhear something that wasn’t desired to be made public

42. Privacy ECPA It is argued that under certain conditions
Prior consent of one of the participants in a communication
Organization can search employees communication
Many companies have policies that require employees to sign an agreement to allow their personal communication to be monitored prior to allowing them to use or the company network

43. Conclusion
Laws are constantly evolving in response to developing technology
Issues of Jurisdiction, Legality
Become more vague when
Technology makes privacy much harder to define
Since we are “technologists”
Need to be aware of the latest laws that affect your rights privately and as a professional
We should be providing input on laws that we believe violate our rights
Patriot Act for example

44. Resource URL's Electronic Privacy Information Center: www.epic.org/
Electronic Freedom Foundation:

45. Resources Digital Evidence and Computer Crime by Eoghan Casey
Understanding and Managing Cybercrime
by Samuel C. McQuade III

46. End
Look for Lab
On your own