Discussion on:

Real-life computer crimes investigation: It's not like on TV

...where the "CSI effect" has created an expectation within potential jurors that the forensic science is so magically high-tech that they're dumbfounded when faced with the methodologically and painstakingly complex and slow science that is the reality.

My favorite is the "we can enhance the fuzzy low-res surveillance video so we can read the license plate on a speeding car 500 feet away via the reflection from someone's sunglasses..."

I served on a jury last year, and there was some concern amongst the jurors that the crime scene was not covered by CCTV. We jurors had to rely almost exclusively on witness statements, and some on the jury were uncomfortable with that. I fear that a universal expectation of high-quality CCTV images will make convictions in the absence of CCTV or forensic evidence harder to achieve.

?

A lady wanted me to do just this off of a gas station camera still. The picture in question was of a car in which two folks had just grabbed her dog and took off. I was able to extract enough features to tell her the state, but not the actual tag contents. And she did ask why couldn't I just "zoom in" on the tag ... very sad because I so wanted to zoom in and get a lead on her dog...

When I worked for a university IT Services department, I was frequently called in to assist the campus police when computers or technical devices were involved in an investigation. They would often ask for things like "Can you tell me whether this individual used this specific computer three weeks ago?" The problem with the request was often that the computer was either a person's privately owned device or a completely public kiosk computer in the library that did not require users to login. They also had the perception that we could magically reconstruct everything a person did while on a computer. Though it might have been technically possible to some extent, we weren't well funded enough to have the tools or time to devote to that level of computer forensics. I must also mention that I had to work with some FBI computer techs when every Solaris server we had was hit with an attack in late fall of 2000. The guy the sent out really knew what he was doing. Luckily for me, I wasn't responsible for the systems that were attacked, but I got to help with the investigation since somebody else was out for a conference or training.

Very good article, and good management training in general. I'd add this regarding the section titled, "Working with real-life law enforcement", first paragraph, second sentence: "...keep in mind that those of higher rank won't necessarily have the best understanding of technology."

There is something else that it can be helpful to consider when dealing with "those of higher rank". The greater the rank, the greater the possibility that the contact may not be as interested in fair and/or accurate results on a project as in short-term (perceived) benefits to self (i.e., "hidden agenda"), typically in the form of enhancing personal standing or finances (i.e., more power); and that goal could require sacrificing a "fall guy", possibly you or your team/group/organization. Warning signs of this situation are: you're having difficulty communicating with the contact's subordinates; the contact appears to ignore the advice of qualified subordinates; the contact does not seem to try to understand important aspects of the project; or you get blank stares from the contact's subordinates when you mention information you provided that should have been passed to them. In the first case, consider refusing or getting off of the project, because it will prevent you from noticing the other three conditions. The other three conditions are good signs that you are being set up for failure, possibly because of a hidden agenda; therefore, try to find a suitable contact at a lower level.

SOP for questioning users about their computer woes...

Taking a cue from my active vision research days it's amazing how little an adult human actually "sees" versus how much we "perceive" with regards to detail.

I live in Mexico, I work primary on media and CGI. But computers are my life love. Thanks to my dad I was in a computer since I was 3 years old, now they are part of my life. I recognize that I have many computer skills that may be hacker skills. But always was for fun and to increase my knowledge. I'm not an engineer, nor a software developer. My mayor is on Social Communications and my other studies are on CGI.

In general I'm a good guy. A few years ago I sell a computer on a site like ebay and was a fraud, I lose my computer (by the way a nice Mac 24") and I really needed the money. So I was so angry and sad, and because the laws in Mexico, it was impossible to reclaim my computer or my money. So I did what I knew how to do. In 3 days I was able to have the picture of the guy, his name, his school mat, his address, cellphone, birthday, etc. I went to the police, and they didn't believe me, nor understand me. So, a few months later I publish the face of this guy in all the newspapers of his little town, and from my City at 1500 km away. I made 1000 posters with his face that were posted over his college, the text was easy "This guy is a thief, if you know him ask him to pay me". Finally I got my money. But with this experience I made a workflow that actually works, Its part computer, part logic, part social engineering, but it works. In this days I'm able to track a cyber thief in less than a week and I had access to some databases in my country I would be able to do it faster and even more precise. I have 3 different cases completed successfully, and its just my hobby.

My equipment is not fancy at all, a Macbook, an old SGI running on BT4, a P4 PC running on WinXP and an iPhone 3GS, yes and iPhone which is maybe the most powerful tool.

The thing is that Cyber-crimes are a new kind of crime, and need a new workflow and a new kind of guys. But I'm certainly believe that its absolutely possible. However I don't have an holographic screen, nor a blonde beauty assistant, I have to work in that.

It's to the benefit of law enforcement to get potential criminals to think their capabilities are greater than they really are. Every TV crime show shows the mounties always get their man. When people think it's not possible to get away with a crime, they're less likely to commit one.

That sort of thing also is to the benefit of police departments when it comes time for their budget. People will pony up the money if they think it will bestow magical abilities on the cops.

So if you own a business that runs on computers and some type of cyber-crime takes place, the police will seize all your machines and all your back ups and put you completely out of business so they can investigate?
No wonder most companies don't report hacks or intrusions. It's easier to take a one time hit and stay in business to recover from it than to let the police put you completely out of business... remember your creditors still want their money even if the cops shut your operations down by seizing all your equipment and back ups.
You, the victim of a crime could be the only one punished, or at least punished way more severely than the bad guy.
If paying your mortgage depends on income from your business, you will lose your house too.
I say all this because everything I do to make money right now from website development to video editing depends on these machines and the software on them. If the cops came in and took it all I'd be totally Fv@kd.
I also know that here in Detroit, whatever the cops take, you will NEVER EVER see again, even it it was rightfully and legally yours and they just took it to "examine" it... It's Gone, go buy another one you'll never see that one again.
OK buy new computers, fine, what about all the software and irreplaceable data... stuff you thought you were smart about backing up onto removable drives? You said the cops are going to take all that too. sounds like you have to do daily back ups to external devices that you keep off premises at a location the cops don't know about and can't find. Damn now you're acting like a criminal just to protect your business.

One of the actors in a CSI series commented when asked about this subject and replied that on TV they have to solve a crime in 43 minutes.
The same applies to courtroom dramas. In real life a main witness may spend several days being questioned and cross examined.
In Medical shows it may take a doctor weeks to compete a full series of tests. A simple analysis of a bacteria could take several days.
With cyber crime the all these magical tools used on TV simply don't exist or if they did very few policing departments could afford them. Face recognition software for example is not where as sophisticated as we a re lead to believe. For every on person on earth there are thousands of others who look similar so getting a "hit" as they do on TV is just not possible.
Unfortunately people expect the same instant results as they see on TV.