Transcription of Investigative Uses of Technology: Devices, Tools, and ...
1 Department of Justice Office of Justice Programs National Institute of Justice Special OCT. 07 REPORT Investigative Uses of Technology: Devices, Tools, and Techniques Department of Justice Office of Justice Programs 810 Seventh Street Washington, DC 20531 Peter D. Keisler Acting Attorney General Cybele K. Daley Acting Assistant Attorney General David W. Hagy Acting Principal Deputy Director, National Institute of Justice This and other publications and products of the National Institute of Justice can be found at: National Institute of Justice Office of Justice Programs Innovation Partnerships Safer Neighborhoods 01-Chap 1 InvestigTech 10/10/07 12:41 PM Page iOCT. 07 Investigative Uses of Technology: Devices, Tools, and Techniques NCJ 213030 01-Chap 1 InvestigTech 10/10/07 12:41 PM Page iiDavid W. Hagy Acting Principal Deputy Director, National Institute of Justice This document is not intended to create, does not create, and may not be relied upon to create any rights, substantive or procedural, enforceable by law by any party in any matter civil or criminal.
2 Photos used in this document are taken from public Web sites; they are in no way an endorse ment of the product illustrated. Opinions or points of view expressed in this document represent a consensus of the authors and do not necessarily reflect the official position or policies of the Department of Justice. The products, manufacturers, and organizations discussed in this document are presented for informational purposes only and do not constitute product approval or endorsements by the Department of Justice. This material should not be relied upon as legal advice. Those considering legal issues related to the use of high-tech materials should consult with their legal counsel. This document was prepared under Interagency Agreement #2003 IJ R 029 between the National Institute of Justice and the National Institute of Standards and Technology, Office of Law Enforcement Standards.
3 The National Institute of Justice is a component of the Office of Justice Programs, which also includes the Bureau of Justice Assistance; the Bureau of Justice Statistics; the Community Capacity Development Office; the Office for Victims of Crime; the Office of Juvenile Justice and Delinquency Prevention; and the Office of Sex Offender Sentencing, Monitoring, Apprehending, Registering, and Tracking (SMART). 01-Chap 1 InvestigTech 10/10/07 12:41 PM Page iiiTechnology Working Group for Investigative Uses of High Technology* Planning panel James R. Doyle First Group Associates New York, New York Joseph Duke Drive-Spies, LLC Clarkston, Michigan Barry Grundy Computer Crime Investigator/ Special Agent NASA Office of the Inspector General Office of Investigations Computer Crimes Division Goddard Space Flight Center Greenbelt, Maryland Keith Hodges Senior Instructor, Legal Division Federal Law Enforcement Training Center Glynco, Georgia Dan Mares President Mares and Company Lawrenceville, Georgia Mark J.
4 Menz M. J. Menz and Associates Folsom, California Robert Morgester Deputy Attorney General State of California Department of Justice Office of the Attorney General Criminal Law Division Sacramento, California Phillip Osborn Senior Special Agent National Program Manager Cyber Crimes Center (C3) Bureau of Immigration and Customs Enforcement (ICE) Department of Homeland Security Fairfax, Virginia John Otero Lieutenant Computer Crimes Squad New York Police Department New York, New York David Poole Chief Information Operations and Investigations Air Force Office of Special Investigations Andrews Air Force Base, Maryland Michael Weil Huron Consulting Group Chicago, Illinois Technology working group members Todd Abbott Vice President Corporate Information Security Bank of America Charlotte, North Carolina Abigail Abraham Assistant Attorney General Illinois Attorney General s Office Chicago, Illinois David Arnett Detective Arizona Department of Public Safety Phoenix, Arizona iii 01-Chap 1 InvestigTech 10/10/07 12.
5 41 PM Page ivDave Ausdenmoore Don Flynn Detective Attorney Advisor Regional Electronics and Computer Department of Defense Investigation Section Cyber Crime Center Hamilton County Sheriff s Office/ Linthicum, Maryland Cincinnati Police Department Cincinnati, Ohio Griffin Assistant Inspector in Charge Rick Ayers Digital Evidence Unit National Institute of Standards and Postal Inspection Service Technology Dulles, Virginia Gaithersburg, Maryland Amber Haqqani Ken Basore Director, Digital Evidence Director of Professional Services American Academy of Applied Forensics Guidance Software (EnCase) Central Piedmont Community College Reston, Virginia Charlotte, North Carolina David Benton Dave Heslep Chief Systems Engineer Sergeant Home Depot Technical Assistance Section Supervisor Atlanta, Georgia Maryland State Police Technical Investigation Division Walter E. Bruehs Columbia, Maryland Forensics Examiner Forensic Audio, Video and Imaging Chip Johnson Analysis Unit Lieutenant Federal Bureau of Investigation South Carolina Computer Crime Center Quantico, Virginia Columbia, South Carolina Carleton Bryant Nigel Jones Staff Attorney NSLEC Centre for National High Tech Knox County Sheriff s Office Crime Training Knoxville, Tennessee Wyboston Lakes Business and Leisure Centre Scott Christensen Bedfordshire, England Sergeant Computer Crimes/ICDC Unit Keith Kelly Nebraska State Patrol Telecommunication Specialist Omaha, Nebraska Washington, Bill Crane Tom Kolpacki Assistant Director Detective National White Collar Crime Center Ann Arbor Police Fairmont, West Virginia Livonia, Michigan iv 01-Chap 1 InvestigTech 10/10/07 12.
6 41 PM Page vAl Lewis Special Agent Investigator/DE Examiner USSS Electronic Crimes Task Force Chicago, Illinois Glenn Lewis Computer Training Specialist Training Services SEARCH Group, Inc Sacramento California Thomas Musheno Forensic Examiner Forensic Audio, Video and Image Analysis Federal Bureau of Investigation Engineering Research Facility Quantico, Virginia Larissa O Brien Chief, Research and Development Information Operations and Investigations Air Force Office of Special Investigations Andrews Air Force Base, Maryland Timothy O Shea Assistant Attorney Western District of Wisconsin Senior Litigation Counsel Computer Crime and Telecommunications Coordinator Madison, Wisconsin Thom Quinn Program Manager California Department of Justice Advanced Training Center Rancho Cordova, California Henry (Dick) Reeve General Counsel Deputy District Attorney Denver District Attorney s Office Denver, Colorado Jim Riccardi, Jr.
7 Electronic Crime Specialist CyberScience Lab National Law Enforcement and Corrections Technology Center Northeast Rome, New York Richard Salgado Senior Counsel Computer Crime and Intellectual Property Section Department of Justice Washington, Chris Stippich President Digital Intelligence, Inc. Waukesha, Wisconsin Facilitators Susan Ballou Program Manager for Forensic Sciences Office of Law Enforcement Standards National Institute of Standards and Technology Gaithersburg, Maryland Anjali R. Swienton President & CEO SciLawForensics, Ltd. Germantown, Maryland *This information reflects each panel member s professional affiliation during the time that the majority of the technology working group s work was performed. v 01-Chap 1 InvestigTech 10/10/07 12:41 PM Page viiContents Technology Working Group for Investigative Uses of High Technology.. iii Introduction.. 1 Chapter 1.
8 Techniques .. 3 Introduction.. 3 Investigative assistance .. 3 Information gathering .. 3 Digital evidence.. 6 Electronic communications.. 8 Telecommunications .. 11 Video surveillance .. 12 Consensual monitoring .. 13 Tracking .. 13 Practical example.. 14 Chapter 2. Tools and Devices .. 21 Introduction.. 21 Power concerns with battery-operated devices .. 21 Access-control devices .. 22 Answering machines and voice mail systems (digital and analog) .. 24 Audio: Digital tools used to conduct examinations of audio formats .. 26 Caller ID devices .. 28 Cell phones.. 30 Computers (desktops and laptops).. 34 Credit card fraud devices .. 36 vii 01-Chap 1 InvestigTech 10/10/07 12:41 PM Page viiiSPECIAL REPORT / OCT. 07 Customer or user cards and devices.. 38 Data preservation (duplicating, imaging, copying).. 40 Detection and interception (wireless).. 44 Digital cameras and Web cameras.
9 46 Digital security cameras .. 48 Encryption tools and passphrase protection.. 50 Facsimile (fax) .. 53 Global positioning system devices .. 55 Home entertainment.. 57 Internet tools.. 59 Internet tools to identify users and Internet connections ( Investigative ) .. 61 Keystroke monitoring .. 68 Mass media copiers and duplicators.. 73 Pagers .. 74 Pens and traps.. 76 Personal digital assistants.. 77 Removable storage media and players .. 80 Sniffers .. 84 Steganography .. 86 Vehicle black boxes and navigation systems.. 87 Video and digital image analysis tools.. 89 Voice recorder (digital).. 91 viii 01-Chap 1 InvestigTech 10/10/07 12:41 PM Page ixINVESTIGATIVE USES OF TECHNOLOGY: DEVICES, TOOLS, AND TECHNIQUES Chapter 3. Legal Issues for the Use of High Technology.. 93 Introduction.. 93 Constitutional issues.. 93 Searches and seizures pursuant to warrants.
10 94 Warrantless searches .. 96 Statutes that affect the seizure and search of electronic evidence.. 98 Appendix A. Glossary .. 107 Appendix B. Technical Resources List .. 117 Appendix C. Hacked Devices .. 131 Appendix D. Disclosure Rules of ECPA.. 135 Appendix E. Sample Forms.. 137 Appendix F. References.. 151 Appendix G. List of Reviewing Organizations.. 153 Index .. 155 ix 01-Chap 1 InvestigTech 10/10/07 12:41 PM Page 1 Introduction This special report is intended to be a resource to any law enforcement personnel (inves tigators, first responders, detectives, prosecutors, etc.) who may have limited or no experience with technology-related crimes or with the tools and techniques available to investigate those crimes. It is not all inclusive. Rather, it deals with the most common techniques, devices, and tools encountered. Technology is advancing at such a rapid rate that the information in this special report must be examined in the context of current technology and practices adjusted as appro priate.
