Professional Documents
Culture Documents
Close P: Cyber Crime and Cyber Terrorism NEW
Close P: Cyber Crime and Cyber Terrorism NEW
E D E R A L
U D I C I A L
E N T E R
APRIL 2002
whats
NEW
by Mark Sherman
outside of the district in which the issuing court is located,
thus enabling courts with jurisdiction over investigations
to compel evidence directly, without requiring the inter-
amends the wiretap statute (18 U.S.C. 2516) by adding felony violations of the computer hacking statute (18 U.S.C.
The Federal Judicial Center provides this publication to further its statutory mission to develop and conduct education programs for judicial branch employees. While encouraging
court staff to share ideas, views, and resources by contributing information from their courts, the Center does not control or verify the accuracy or completeness of the information.
Nor does inclusion herein of the information constitute the Centers approval or endorsement of it. The views expressed in this publication are those of the author and contributors.
Close-up
April 2002
as a wiretap order)
Close-up
April 2002
Cyber-specific special
conditions: recent case law
puter use.
Cir. 2001) the U.S. Court of Appeals for the Tenth Circuit held that a special condition of supervised release
for the exclusive use of federal probation and pretrial services. To apply for access, go to http://www.cybercrime.flmp.
uscourts.gov.
Supervision of the Cyber-savvy Offender or Defendant is
a listserv (e-mail forum) maintained by the Eastern District
of New York and facilitated by federal probation and pretrial
services officers from several districts. Topics range from
basic to advanced. Membership is open to federal court employees. Topics include reviews of monitoring and forensics
software, development of cyber-specific special conditions
and policies, and training opportunities. To join, register
at http://apollo.nyed.circ2.dcn/cgi-bin/wa?SUBED1=
cybercrime&A=1.
The Court Operations Exchange is an electronic forum
maintained by the Federal Judicial Center for court staff to
share information and ideas. The Exchange contains topical
discussions related to cyber crime. To gain access, log onto
the Centers DCN intranet site at http://jnet.fjc.dcn, click
Court Staff Education, then scroll down the menu and click
Court Operations Exchange.
that prohibited the defendant, who had been convicted of receiving child pornography but had not used
a computer to do so, from possessing a computer
with Internet access was ambiguous and remanded
the case to the district court for clarification. The court
noted that the condition was at the same time potentially too narrow and overly broad and did not
comport with either statutory requirements or the
realities of the Internet and its rapidly changing technologies.
In United States v. Walser, 275 F.3d 981 (10th
Cir. 2001) the U.S. Court of Appeals for the Tenth
Circuit affirmed the district courts imposition of a special condition barring the defendants use of or access to the Internet without the prior permission of
the U.S. probation officer. The case involved a conviction for possession of child pornography that had
been downloaded from the Internet onto the defendants personal computer. In upholding the condition, the court stated that the condition of release
is not as ill-tailored as the one at issue in White
[because the defendant] is not completely banned
from using the Internet. Rather, he must obtain prior
permission from the probation office. Thus, the condition more readily accomplishes the goal of restricting use of the Internet and more delicately balances
the protection of the public with the goals of sentencing.
Close-up
April 2002
Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations provides specific
guidance for carrying out computer searches to comply with
constitutional and statutory guidelines. (Available at http://
www.cybercrime.gov/searchmanual.htm)
connected devices, they involve offenses in which computers or connected devices may be instruments.
(202) 406-5850).
whats
HOT
With the approval of the chief, one of the coordinators initiated the Northern Ohio Probation Cybercrime Working Group,
which consists of the chief and members of the management
team, probation officers, and representatives from the offices
automation unit. After the working group identified several
needed tasks and duties, the district created a specialist posi-
For more on the USSCs reasons for these amendments, see its Guidelines Manual Supplement to
Close-up
April 2002
tion. The officer occupying the position had served as the dis-
force, conducts in-district cyber crime training, and has completed a needs assessment on cyber crime for the district.
Electronic Crimes Task Force and the High Tech Crime Con-
in the district. The district uses monitoring software to monitor defendants computer use.
courtoperations/fcsd/html/federalprob.htm.
District of Columbia probation has designated a line ofFlorida Middle probation created an electronic informa-
FLETC.
least one member from each unit in the office, (i.e. supervi-
Newvilles article Cyber Crime and the CourtsInvestigating and Supervising the Information Age Offender
jnet.ao.dcn/courtoperations/fcsd/html/federalprob.htm.
Close-up
April 2002
fcsd/html/search__seizure.htm.
Kansas (combined) has developed a search policy that
Information gathering
Special conditions
New York Eastern probation has developed a bench guide to
assist judges with such issues as classification and wording of
special conditions. The guide includes the following cyberspecific special conditions:
The defendant is not permitted to access a computer
any time.
encryption.
Close-up
April 2002
ficers and agencies (e.g., civil liability) and the public (e.g.,
harming or causing the loss of electronic evidence that could
be used in a future prosecution). Experienced officers advise
that under no circumstances should such applications be used
by an individual who has not been trained in their use and advised about their appropriateness.
SEARCH, the National Consortium for Justice Information and Statistics, has evaluated five commercial computer monitoring programs available for use by probation and pretrial services officers. The five
products tested were Boss Everywhere 2.3,
Desktop Surveillance 3.6b, Eblaster 2.0,
PC Activity Monitor Pro 4.0, and STARRtm PC and Internet Monitor 3.02 Pro.
The evaluation report is available at
http://www.search.org/publications/
bibliography.asp.
itoring program.
For more information on questions to ask cyber offenders
whats
HOT
plications is critical for the officer and the court. For example,
Close-up
April 2002
Monitoring applications
uscourts.gov).
puter, and any images accessed. The tool is limited in that in-
tions and files are stored on the offenders hard drive and
ware); all passwords used by you; and your Internet Service Provider(s); and will abide by all rules of the Computer Restriction and Monitoring Program.
General Provisions
1. I, ____________________ , have been placed in the Computer Restriction and Monitoring Program. I agree to comply with all program rules
set forth in this agreement, and the instructions of my probation officer. I understand that this agreement is, by reference, part of the order setting
conditions and that failure to comply with its provisions or the instructions of my officer will be considered a violation of my supervision and
may result in an adverse action. I agree to call my officer immediately if I have any questions about these rules or if I experience any problems
that may hinder my compliance with this program.
2. I understand I must complete the Computer/Internet Data Form and return within seven days.
3. I shall possess and/or access only computer hardware or software approved by the U.S. Probation Office. I shall obtain written permission from
the U.S. Probation Office prior to obtaining or accessing any additional computer hardware/software or making any alterations to my system.
4. I shall only use Internet Service Providers(s) approved by the U.S. Probation Office. I shall obtain written permission from the U.S. Probation
Office prior to changing ISP or entering into agreements with any additional ISP.
5. I agree to allow the U.S. Probation Officer to install software/hardware designed to monitor computer activities on any computer I am authorized to use. I understand that the software may record any and all activity on my computer, including the capture of keystrokes, application information, Internet use history, email correspondence, and chat conversations. I further understand that a notice will be placed on the computer
at the time of installation to warn others of the existence of the monitoring software on my computer. I agree not to attempt to remove, tamper
with, reverse engineer, or in any way circumvent the software/hardware.
6. I understand that my supervising officer may use measures to assist in monitoring compliance with these conditions such as placing tamper resistant tape over unused ports and to seal my computer case.
7. I will notify all individuals that have access to my computer system that it subject to monitoring and/or search/seizure.
8. I shall not create or assist directly or indirectly in the creation of any electronic bulletin board, ISP, or any other public or private network without the prior written consent of the U.S. Probation Office. Any approval shall be subject to any condition set by the U.S. Probation Office or the
Court with regard to that approval.
9. I understand the U.S. Probation Office may determine a Web site and/or material is a detriment to my success in this program and therefore prohibit future access to said Web site/materials. I will abide by this decision pending any ruling by the Court to the contrary.
10. I understand that my officer will use telephone calls and unannounced personal visits to monitor my compliance. When I am at home, I agree to
promptly answer my telephone or door.
11. I will provide copies of credit card billing records or other financial records monthly and will not open any new lines of credit without authorization of my supervising officer. I understand that my supervising officer has the authority to request my credit history information to confirm
my compliance with the conditions of release and these program rules. My signature on this document signifies my consent for the release of the
credit history information.
Defendant
Date
Supervising Officer
Date
Close-up
April 2002
uscourts.gov).
col (IP) address. The tool can serve as a deterrent if the defendant or offender knows the officer could be watching at any
time. The basic application is free. For more information, go
to http://www.anonymizer.com. Reviewed by USPO Monica
Hampton ([email protected]).
Forensic Tools
Web site and the sites location. SamSpade works best when
officer can perform initial previewing of a target drive, acquire evidentiary images, search and recover data, and obtain
reports within the same application. Use of the tool does not
Close-up
10
April 2002
files, and file slack. The officer can pick which files to save
into the Case Manager feature and allows various reports to
be submitted. It can be installed onto a laptop for examinations in the field. Easy to use, the tool is not a true forensic
application: The user cannot pick and choose which files to
view and must perform a scan first. For more information, go
to http://www.computercop.com. Reviewed by Sr. USPO
Brian Kelly ([email protected]).
Ilook Investigator. This program can be used to examine
images obtained from any forensic imaging system that creates a straight sector dump of the imaged media. It may also
be used to examine Safeback image files, EnCase image files,
ISO and CIF CD images, VMWare virtual disks, and ILook image files. Ilook, which consists of a main executable file, runtime files, and on-line help, will run on Windows NT and
2000. The application has a steep learning curve but is available free to law enforcement. For more information, go to
http://www.ilook-forensics.org. Reviewed by Sr. USPO Dan
Wieser (Florida Middle) (retired).
External Training
The training programs described below are advanced. Information on introductory and basic technical training can be
found on page 14 of Introduction to Cyber Crime.
National White Collar Crime Center/National Cybercrime Training Partnership. NW3C/NCTP, a Department of
Justice-funded organization, offers Advanced Data Recovery
and Analysis (ADRA). This in-depth, 40-hour course, which is
taught only at NW3C headquarters in Fairmont, West Virginia, covers large hard drives, new partition types, Windows
NT/2000/XP NTFS, advanced imaging, alternate media, transient data, and Internet issues. It is free and is limited to 20
students. Prior computer forensic training is required. Several
federal probation and pretrial services officers have participated in NW3C courses. For more details, see http://www.
cybercrime.org for more details.
FLETC-SCERS. This two-week advanced course exposes
participants to a variety of imaging and forsenic tools. Not
only do individuals learn important skills, they are also provided software and hardware to complete forensic investigations. Software is available exclusively to those who complete
Training
Internal Training
Kansas (combined) conducts a oneday program for officers about types
the course. Until recently, the course was offered only at the
whats
HOT
Close-up
11
April 2002
portant data, could be far more serious and costly than the
part of the searcher causes such loss, the potential for lia-
The Privacy Protection Act (PPA) and the Electronic Communications Privacy Act (ECPA) both create liability for
computer searches that violate their provisions. However,
might occur.
The PPA (42 U.S.C. 2000aa et seq.) specifies that government officers, in connection with the investigation or
prosecution of criminal cases, may not search for or seize
work product and other documents intended for public
dissemination unless there is probable cause that the per-
tutes a search.
Close-up
12
April 2002
district but would like some guidance from the field. Has
anyone in the system put together a district policy for cyber
crime or cyber offenders?
A: The following probation and pretrial services offices have
developed or are developing cyber crime programs of varying complexity in their districts: Texas Western pretrial services, Arizona pretrial services, Kansas (combined), Florida
Middle probation, South Carolina probation, New York
Western (combined), District of Columbia probation, Ohio
Northern probation, and Montana (combined). Contact information for lead officers in each of these districts, as well
as for other officers who have developed individual cyber
crime expertise, can be found throughout this Close-up.
and to serve as liaison for systems personnel, the U.S. attorney, and professional development organizations.
Close-up
13
April 2002