Sep 11, 2012 – ASIS 58

Social Media & Cloud Computing Threats to Privacy, Security and Liberty, Session 3183
http://www.asis2012.org/Pages/Seminar-Home-Page.aspx

Social Media has quickly woven itself into the very fabric of everyday life. This boom in sharing, even the most banal of details, has had a resounding impact on how our children, employees and colleagues communicate.

Using case studies from the US and around the world, we’ll examine how people have lost jobs, college admissions, college degrees, fortunes and freedom through (un)social media.

We’ll also investigate the rampant OVERCOLLECTION of customer and subscriber data by major corporations and governments.

We’ll also discuss some strategies and steps we can take to protect civil liberties and privacy in the age of Social Media.

Social Media & Cloud Computing Threats to Privacy, Security and Liberty

Social Media has quickly woven itself into the very fabric of everyday life. This boom in sharing, even the most banal of details, has had a resounding impact on how our children, employees and colleagues communicate.

Using case studies from the US and around the world, we’ll examine how people have lost jobs, college admissions, college degrees, fortunes and freedom through (un)social media.

We’ll also investigate the rampant OVERCOLLECTION of customer and subscriber data by major corporations and governments.

We’ll also discuss some strategies and steps we can take to protect civil liberties and privacy in the age of Social Media.

Here’s a fascinating article from Phys.org on how the US DOJ is getting cellular location data from cell carriers (neatly bypassing the 4th amendment protections) and how technology has increased the reach of the government into our daily lives.

Is using cell-phone data for tracking purposes a violation of privacy? Does it violate any constitutional requirements?

The short answer is: We don’t know. The Supreme Court hasn’t decided yet, though police are clearly doing it all the time. The basic test of what violates the Fourth Amendment is whether the government action is “unreasonable” search and seizure. The Supreme Court has just decided, in the United States v. Jones case, that it’s unreasonable for police to attach a GPS tracker to someone’s car in order to remotely monitor that car’s movements full time for a month, without first getting a warrant.

…

The biggest threats to our privacy nowadays are probably those we create for ourselves, by giving out information to make our lives easier. Through the use of credit cards, email and mobile devices, we allow many private entities to collect all kinds of information about us, and, where it isn’t protected by some statute, those entities can sell that information to anyone willing to pay for it. The Constitution can’t protect us very well against giving our information away.

What obligation do service providers have to give tracking data to law-enforcement agencies, particularly when no warrant has been obtained?

[the cellphone carrier] may be willing to sell that information, if the price is right, and if it thinks that its customers won’t care, or won’t notice.

…

How has the pervasiveness of digital content and growing digital footprints influenced law-enforcement practices? In general, does it complicate or aid criminal investigations?

in addition to GPS tracking (which can be performed by police with a warrant), the government is likely to collect all the electronic information it can get in order to help prove its case: cell-phone data, hard drives, emails, credit card, bank transactions, etc. Digital-evidence collection has vastly increased the amount of data that must be processed, and it requires entirely new kinds of expertise. The courts are still sorting out just how far police can go in looking through someone’s hard drive if they have probable cause to believe that they’ll find incriminating information.

via 3Qs: Mobile tracking in criminal investigations.

In a rare show of honesty, Sergey Brin admitted that

 their data that was now in the reach of US authorities because it sits on Google’s servers. He said the company was periodically forced to hand over data and sometimes prevented by legal restrictions from even notifying users that it had done so.

Of course, he conveniently points the finger at his rivals – Facebook, Apple, Hollywood (RIAA/MPAA).

Yes Sergey, your competition is evil.  So’s your company.  If you don’t want the US government demanding access to all the data that Google collects, then STOP COLLECTING so much data.  START telling your users about the threats to THEIR privacy that you’ve created.  A Google Good-To-Know about ECPA and PATRIOT ACT would be so much nicer than your current ads.

The threat to the freedom of the internet comes, he claims, from a combination of governments increasingly trying to control access and communication by their citizens, the entertainment industry’s attempts to crack down on piracy,

From the attempts made by Hollywood to push through legislation allowing pirate websites to be shut down, to the British government’s plans to monitor social media and web use, the ethos of openness championed by the pioneers of the internet and worldwide web is being challenged on a number of fronts.

In China, which now has more internet users than any other country, the government recently introduced new “real identity” rules in a bid to tame the boisterous microblogging scene. In Russia, there are powerful calls to rein in a blogosphere blamed for fomenting a wave of anti-Vladimir Putin protests. It has been reported that Iran is planning to introduce a sealed “national internet” from this summer.

via Web freedom faces greatest threat ever, warns Google’s Sergey Brin | Technology | The Guardian.

In the EU-vs-Facebook cases, Facebook has sent european citizens 800 PAGES of documents.

In the US, a subpeona merits 62 pages.

So, either the Craigslist killer didn’t use Facebook as much as a dummy German profile, or Facebook held back hundreds of pages of data.  You decide.

If you’d like the full PDF, grab it from http://dl.dropbox.com/u/105727/fb-subpoena-db/index.html

From ZDNET:
The 71-page document is actually two documents in one. The first eight pages are the actual subpoena;the remaining 62 pages are from Facebook. Most of the pages sent over from the social networking giant consist of a single photograph, plus formal details such as the image’s caption, when the image was uploaded, by whom, and who was tagged. Other information released includes Wall posts, messages, contacts, and past activity on the site.

The document was released by the The Boston Phoenix as part of a lengthy feature titled “Hunting the Craigslist Killer,” which describes how an online investigation helped officials track down Philip Markoff. The man committed suicide, which meant the police didn’t care if the Facebook document was published elsewhere, after robbing two women and murdering a third.

via Here’s what Facebook sends the cops in response to a subpoena | ZDNet.

According to surveys of U.S. and U.K. matrimonial attorneys, more and more of them are asking (or requiring) their clients to disclose Facebook, Twitter, LinkedIn, and other social media credentials to the attorney start of the case. The retained counsel has no wish to be surprised in court, by finding out that his or her client said or posted things online that are detrimental to the case.1

As a Cyberforensics consultant, I ask the following questions when working with lawyers in order for my clients to get the best results possible when fighting matrimonial cases:

1) Does your client (the wife, husband or partner) have a legal right to the computer or smartphone? If the device is jointly owned, then we can image and analyze it. If the device is owned by the other person’s employer, or is somehow construed as private property, then we do not have the legal right to analyze it, without a court order.

2) Has a PRESERVATION LETTER been issued to the opposing side?

3) Has either side retained an expert to acquire multiple copies of legally compliant forensics images? If both sides agree that the image is forensically sound, then both sides can invest resources in evidence analysis, not re-acquisition.

4) How many devices are owned by the couple? Computers, laptops, smartphones, etc.

5) Do they have any shared passwords to e-mail, online banking, Facebook, LinkedIn, etc? If yes, then we ask the attorney retaining us to determine (and advise us in writing) whether their client still has a legal right to those passwords, now that the divorce process has started.

6) What are we looking for? Financial records? Evidence of online romances? Deleted files and documents?

The best way to minimize forensics costs is to limit what we need to look for.

Every client has something to hide.

Guide your forensics investigator – frame the request as narrowly as possible. For example, “find me financial records” or “we suspect he’s hiding funds offshore” or “she’s got a shopping addiction” or “we suspect he’s having an affair.”

7) Has anyone used non-forensics software to try an undelete files or used a non-forensic computer technician to gather evidence? If so, then there’s a possibility that the evidence is spoiled and cannot be used in court. Based on my experience, even when the evidence cannot be presented in court, it often results in negotiated settlements.

8 ) Is there any suspicion of child pornography (CP) on the device(s)?

Under current Federal laws, if we encounter more than three items of CP, we are legally obligated to stop work and report it to the FBI, Secret Service and ICE. Unlike any other form of evidence, mere possession of CP by an attorney (or their consultants) is illegal under federal law2,3 and attorneys have been prosecuted for possessing CP while they were conducting research on behalf of their clients.

 See the case of Attorney Leo Thomas Flynn at  www.brunolaw.com/prosecutionserves-as-warning.html.

 Below are several case studies that illustrate the above points:

 1) In a case, the family kept using the shared computer(s) months after the divorce was filed. Analysis of the data revealed that the husband had lied to the wife, and his attorney, about what he did with the couple’s sex tapes, which were on the shared computer. Since the entire family (husband, wife, children, guests, etc.) used the same user name and password to log in to the computer, it was forensically impossible to tell who created, modified or deleted files — this evidence was considered polluted and could not be used in court. While this evidence could not be used in court, it assisted the wife’s attorney in negotiating a favorable settlement.

2) In another case, the husband fled from his native country to the U.S. 18 months ago. The wife followed suit six months later. She brought the family laptop with her, and presented it to her U.S. attorney as evidence.  Having established the dates of his departure, and her departure from their native country, we started the analysis. We located some financial records. We also found large stashes of adult imagery from dating sites–both male and female dating profiles.  The initial conclusion we drew was that the husband was having a homosexual affair, or was bisexual, due to the prevalence of both male and female dating profiles. Upon review, the wife rejected the analysis. The discrepancies in the dates of profiles led us to re-interview the wife, with counsel present. During this re-interview, we discovered that after the husband had fled, the wife’s sister has used the laptop to engage in online dating for the intervening six months. Because the client allowed her sister to use the laptop for six months, and did not communicate this with the attorney, all digital evidence had to be thrown out, because it was spoiled.

Defending Against Cyber Evidence

When defending against cyber-evidence, determine the legality of the evidence. In most cases, the evidence was spoiled or may have been collected illegally. Determine the correctness of evidence – the data may have been collected legally – but was it collected and analyzed correctly?

In one case, the client was charged with 107 counts, based on the fact that he clicked on one link, and the popup downloaded 50 images on the hard drive. Analysis by the author was able to prove that these were the result of popups downloading multiple images per click, and should therefore be counted as one violation per popup or web page. In the end, the client was charged with five counts–a far cry from the initial 107.

Social Media and Cloud Evidence

While we cannot gather forensic evidence from cloud providers (Facebook, Gmail, Twitter, World-of-Warcraft (WOW), Farmville, etc.), in many cases, once references to these services have been located on the clients’ hard drives, you can subpoena log files from these providers. Facebook, WOW, and EZ-pass are great places to acquire digital evidence.

Raj Goel is founder and CTO of Brainlink International, Inc.  Learn more at www.RajGoel.com andwww.Brainlink.com.

References

 1. www.guardian.co.uk/technology/2011/mar/- 08/facebook-us-divorces,

 http://www.dailymail.co.uk/femail/article-2080398/Facebook-cited-THIRD-divorces.html,

 http://kotaku.com/5576262/farmville-world-of-warcraft-are-divorce-lawyers-latest-weapons-in-court

 2. www.orangecountycriminaldefenselawyerblog.com/2011/02/in-orange-county-ca-whathappe.html

 3. www.brunolaw.com/prosecution-serves-as-warning.html

This article appears in the April 2012 issue of New York County Lawyers Association (NYCLA)  Newspaper on pages 5 & 15.  The PDF is available at http://www.brainlink.com/whitepapers/2012-04-04-New-York-County-Lawyer-April-2012-Cyberforensics.pdf

It’s not just kids anymore – adults with quirky humor, facebooking on their own time, with their own equipment are also being harassed.

From Time.com:

A teacher’s aide in Michigan was let go from her job after a school administrator demanded that she turn over her Facebook password and she refused. The aide, Kimberly Hester, is preparing for a legal showdown with the school system. The incident that prompted administrators to ask Hester for her password occurred last spring. According to local news station WSBT, “She jokingly posted a picture of a co-worker’s pants around her ankles and a pair of shoes, with the caption ‘Thinking of you.’” Hester wasn’t using Facebook during school hours or at a school computer, but her brand of humor got her in hot water at work anyway.

via Facebook: Employer Fires Aide Over Refusal to Give Up Facebook Password | Moneyland | TIME.com.

The IP address of a computer used to view a motorbike sales ad posted by an early victim of the Toulouse gunman played a vital role in narrowing down Mohamed Merah as the main suspect in a series of attacks that have horrified France, it has emerged.

French soldier Imad Ibn-Ziaten posted a video of the motorbike he wanted to sell online. The paratrooper was killed on 11 March after he invited someone who posed as a prospective buyer to his house.

Le Monde reports (Google translation here) that the ad was viewed by about 500 people. Cyber police narrowed down the list of likely suspects to those who lived in and around Toulouse in south-west France. This search was intensified after Ibn-Ziaten’s assassination was linked to the slaughter of three children and a rabbi at a Jewish school in Toulouse on Monday, 19 March.

In addition, Le Monde added, a motorcycle dealer had reported a suspicious conversation with someone who wanted to know whether it was possible to remove an anti-theft tracking device from a Yamaha scooter just days before the vehicle was stolen on 6 March and before the first attacks against French soldiers. The twin strands of evidence allowed police to compile a shortlist of suspects.

Merah was already under surveillance by French authorities and the use of an IP address, which was linked to his brother’s house, to view Ibn-Ziaten’s motorcycle video made him a prime suspect in the case.

via Cybercops traced Toulouse massacre suspect through IP address • The Register.

What can we learn from the Dharun Ravi case?

1) All the evidence was digital / social media

2) Dharun’s computers & phones self-incriminated him

They relied primarily on statements that Ravi made through conversations and text messages with friends as well as actions that he took using technology and social media without Clementi’s initial knowledge, to establish his bias and intent to intimidate. It was questionable whether this unorthodox approach toward establishing Dharun Ravi’s mental state would hold water with the jury.
http://www.huffingtonpost.com/matt-semino/dharun-ravi-trial_b_1365027.html

3) Because of a teenager’s stupid mistakes, 2 families are destroyed. Tyler Clemente’s lost a son. Dharun Ravi’s lost a future.

4) Social media bullying is a new field of evidence capture and prosecution

5) Do YOU understand that a computer or smartphone is a loaded handgun or a live grenade? It can hurt others, and blow your hand off?

Can you teach your kids the important lessons from this trial?

Continue Reading