Cyber Forensics A Field Manual For Collecting, Examining, & Preserving Evidence Of Computer Crimes
User Manual: manual pdf -FilePursuit
Open the PDF directly: View PDF 
.
Page Count: 347
| Download | |
| Open PDF In Browser | View PDF |
Cyber Forensics
Table of Contents
Cyber Forensics—A Field Manual for Collecting, Examining, and Preserving Evidence of
Computer Crimes..............................................................................................................................1
Disclaimer...........................................................................................................................................6
Introduction........................................................................................................................................7
Background..............................................................................................................................8
Dimensions of the Problem......................................................................................................9
Computer Forensics...............................................................................................................10
Works Cited......................................................................................................................11
Section I: Cyber Forensics.............................................................................................................13
Chapter List............................................................................................................................13
........................................................................................................................................13
Chapter 1: The Goal of the Forensic Investigation.......................................................................14
Overview................................................................................................................................14
Why Investigate.....................................................................................................................14
Internet Exceeds Norm..........................................................................................................14
Inappropriate E−mail..............................................................................................................16
Non−Work−Related Usage of Company Resources.............................................................17
Theft of Information................................................................................................................18
Violation of Security Parameters............................................................................................18
Intellectual Property Infraction...............................................................................................19
Electronic Tampering.............................................................................................................20
Establishing a Basis or Justification to Investigate................................................................21
Determine the Impact of Incident...........................................................................................22
Who to Call/Contact...............................................................................................................24
If You Are the Auditor/Investigator.........................................................................................24
Resources..............................................................................................................................25
Authority.................................................................................................................................25
Obligations/Goals...................................................................................................................25
Reporting Hierarchy...............................................................................................................25
Escalation Procedures...........................................................................................................25
Time Frame............................................................................................................................26
Procedures.............................................................................................................................26
Precedence............................................................................................................................26
Independence........................................................................................................................26
Chapter 2: How to Begin a Non−Liturgical Forensic Examination.............................................27
Overview................................................................................................................................27
Isolation of Equipment...........................................................................................................27
Cookies..................................................................................................................................29
Bookmarks.............................................................................................................................31
History Buffer.........................................................................................................................32
Cache.....................................................................................................................................34
Temporary Internet Files........................................................................................................35
Tracking of Logon Duration and Times..................................................................................35
Recent Documents List..........................................................................................................36
Tracking of Illicit Software Installation and Use.....................................................................37
i
Table of Contents
Chapter 2: How to Begin a Non−Liturgical Forensic Examination
The System Review...............................................................................................................38
The Manual Review...............................................................................................................41
Hidden Files...........................................................................................................................42
How to Correlate the Evidence..............................................................................................43
Works Cited......................................................................................................................44
Chapter 3: The Liturgical Forensic Examination: Tracing Activity on a Windows−Based
Desktop............................................................................................................................................45
Gathering Evidence For Prosecution Purposes.....................................................................45
Gathering Evidence Without Intent to Prosecute...................................................................45
The Microsoft Windows−Based Computer.............................................................................46
General Guidelines To Follow................................................................................................48
Cookies..................................................................................................................................50
Bookmarks/Favorites.............................................................................................................53
Internet Explorer's History Buffer...........................................................................................54
Temporary Storage on the Hard Drive...................................................................................55
Temporary Internet Files........................................................................................................56
System Registry.....................................................................................................................57
Enabling and Using Auditing via the Windows Operating System.........................................61
Confiscation of Computer Equipment....................................................................................65
Other Methods of Covert Monitoring......................................................................................66
Chapter 4: Basics of Internet Abuse: What is Possible and Where to Look Under the
Hood.................................................................................................................................................68
Terms.....................................................................................................................................68
Types of Users.......................................................................................................................69
E−Mail Tracking.....................................................................................................................69
IP Address Construction........................................................................................................69
Browser Tattoos.....................................................................................................................69
How an Internet Search works...............................................................................................70
Swap Files.............................................................................................................................74
ISPs.......................................................................................................................................75
Servers...................................................................................................................................75
Works Cited......................................................................................................................75
Chapter 5: Tools of the Trade: Automated Tools Used to Secure a System Throughout
the Stages of a Forensic Investigation.........................................................................................77
Overview................................................................................................................................77
Detection Tools......................................................................................................................77
Protection Tools.....................................................................................................................84
Analysis Tools........................................................................................................................87
Chapter 6: Network Intrusion Management and Profiling...........................................................91
Overview................................................................................................................................91
Common Intrusion Scenarios.................................................................................................91
Intrusion Profiling...................................................................................................................95
Creating the Profile................................................................................................................96
Conclusion...........................................................................................................................103
ii
Table of Contents
Chapter 7: Cyber Forensics and the Legal System....................................................................105
Overview..............................................................................................................................105
How the System Works........................................................................................................105
Issues of Evidence...............................................................................................................106
Hacker, Cracker, or Saboteur..............................................................................................108
Best Practices......................................................................................................................115
Notes..............................................................................................................................115
Acknowledgments..........................................................................................................116
Section II: Federal and International Guidelines........................................................................117
Chapter List..........................................................................................................................117
......................................................................................................................................117
References.....................................................................................................................118
Chapter 8: Searching and Seizing Computers and Obtaining Electronic Evidence...............118
Recognizing and Meeting Title III Concerns in Computer Investigations.............................123
Computer Records and the Federal Rules of Evidence.......................................................131
Proposed Standards for the Exchange of Digital Evidence.................................................134
Recovering and Examining Computer Forensic Evidence...................................................140
International Principles for Computer Evidence...................................................................141
Chapter 9: Computer Crime Policy and Programs.....................................................................143
The National Infrastructure Protection Center Advisory 01−003..........................................143
The National Information Infrastructure Protection Act of 1996...........................................146
Distributed Denial of Service Attacks...................................................................................157
The Melissa Virus................................................................................................................163
Cybercrime Summit: A Law Enforcement/Information Technology Industry Dialogue........163
Chapter 10: International Aspects of Computer Crime..............................................................165
Council of Europe Convention on Cybercrime.....................................................................165
Council of Europe Convention on Cybercrime Frequently Asked Questions.......................168
Internet as the Scene of Crime............................................................................................168
Challenges Presented to Law Enforcement by High−Tech and Computer Criminals..........169
Problems of Criminal Procedural Law Connected with Information Technology.................169
Combating High−Tech and Computer−Related Crime........................................................169
Vienna International Child Pornography Conference...........................................................171
OECD Guidelines for Cryptography Policy..........................................................................171
Fighting Cybercrime: What are the Challenges Facing Europe?.........................................171
Chapter 11: Privacy Issues in the High−Tech Context..............................................................172
Law Enforcement Concerns Related to Computerized Databases......................................172
Enforcing the Criminal Wiretap Statute................................................................................174
Referring Potential Privacy Violations to the Department of Justice for Investigation
and Prosecution..................................................................................................................174
Testimony on Digital Privacy................................................................................................175
Chapter 12: Critical Infrastructure Protection.............................................................................176
Attorney General Janet Reno's Speech on Critical Infrastructure Protection......................176
Protecting the Nation's Critical Infrastructures: Presidential Decision Directive 63.............176
The Clinton Administration's Policy on Critical Infrastructure Protection: Presidential
iii
Table of Contents
Chapter 12: Critical Infrastructure Protection
Decision Directive 63..........................................................................................................177
Foreign Ownership Interests in the American Communications Infrastructure....................187
Carnivore and the Fourth Amendment.................................................................................188
Chapter 13: Electronic Commerce: Legal Issues.......................................................................195
Overview..............................................................................................................................195
Guide for Federal Agencies on Implementing Electronic Processes...................................195
Consumer Protection in the Global Electronic Marketplace.................................................196
The Government Paperwork Elimination Act.......................................................................196
Internet Gambling................................................................................................................197
Sale of Prescription Drugs Over the Internet.......................................................................197
Guidance on Implementing the Electronic Signatures in Global And National
Commerce Act (E−SIGN)....................................................................................................198
Part I: General Overview of the E−SIGN Act.......................................................................198
The Electronic Frontier: the Challenge of Unlawful Conduct Involving the Use of the
Internet................................................................................................................................215
Internet Health Care Fraud..................................................................................................217
Jurisdiction in Law Suits.......................................................................................................218
Electronic Case Filing at the Federal Courts.......................................................................225
Notes..............................................................................................................................226
Chapter 14: Legal Considerations in Designing and Implementing Electronic
Processes: A Guide for Federal Agencies.................................................................................229
Executive Summary.............................................................................................................229
Introduction..........................................................................................................................237
I. Why Agencies Should Consider Legal Risks....................................................................238
II. Legal Issues to Consider in "Going Paperless"...............................................................242
III. Reducing The Legal Risks in "Going Paperless"............................................................255
Conclusion...........................................................................................................................266
Notes..............................................................................................................................267
Chapter 15: Encryption.................................................................................................................273
Department of Justice FAQ on Encryption Policy (April 24, 1998)......................................273
Interagency and State and Federal Law Enforcement Cooperation....................................273
Law Enforcement's Concerns Related to Encryption...........................................................273
Privacy in a Digital Age: Encryption and Mandatory Access...............................................274
Modification of H.R. 695.......................................................................................................280
Security and Freedom Through Encryption Act...................................................................281
OECD Guidelines for Cryptography Policy..........................................................................285
Recommended Reading................................................................................................285
Chapter 16: Intellectual Property.................................................................................................286
Prosecuting Intellectual Property Crimes Guidance............................................................286
Deciding Whether to Prosecute an Intellectual Property Case............................................286
Government Reproduction of Copyrighted Materials...........................................................286
Federal Statutes Protecting Intellectual Property Rights.....................................................286
IP Sentencing Guidelines.....................................................................................................289
Intellectual Property Policy and Programs...........................................................................292
Copyrights, Trademarks and Trade Secrets........................................................................294
iv
Table of Contents
Section III: Forensics Tools..........................................................................................................296
Chapter List..........................................................................................................................296
......................................................................................................................................296
Chapter 17: Forensic and Security Assessment Tools..............................................................297
Detection, Protection, and Analysis.....................................................................................297
Detection and Prevention Tools for the PC Desktop...........................................................297
Analysis Tools......................................................................................................................299
Applications..........................................................................................................................301
Additional Free Forensics Software Tools...........................................................................307
Chapter 18: How to Report Internet−Related Crime...................................................................308
Overview..............................................................................................................................308
The Internet Fraud Complaint Center (IFCC)......................................................................309
Chapter 19: Internet Security: An Auditor's Basic Checklist....................................................310
Firewalls...............................................................................................................................310
Supported Protocols............................................................................................................311
Anti−Virus Updates..............................................................................................................311
Software Management Systems..........................................................................................312
Backup Processes and Procedures.....................................................................................312
Intra−Network Security........................................................................................................312
Section IV: Appendices.................................................................................................................314
Appendix List.......................................................................................................................314
......................................................................................................................................314
Appendix A: Glossary of Terms...........................................................................................314
A−C................................................................................................................................314
D..........................................................................................................................................317
E−G......................................................................................................................................319
H−I.......................................................................................................................................322
K−Q......................................................................................................................................323
R−S......................................................................................................................................324
T−W.....................................................................................................................................326
Appendix B: Recommended Reading List..................................................................................329
Books...................................................................................................................................329
Articles.................................................................................................................................332
Web Sites.............................................................................................................................333
List of Exhibits...............................................................................................................................337
Chapter 2: How to Begin a Non−Liturgical Forensic Examination.......................................337
Chapter 3: The Liturgical Forensic Examination: Tracing Activity on a Windows−Based
Desktop...............................................................................................................................337
Chapter 4: Basics of Internet Abuse: What is Possible and Where to Look Under the
Hood...................................................................................................................................337
Chapter 5: Tools of the Trade: Automated Tools Used to Secure a System Throughout
the Stages of a Forensic Investigation................................................................................338
Chapter 6: Network Intrusion Management and Profiling....................................................338
Chapter 8: Searching and Seizing Computers and Obtaining Electronic Evidence.............338
v
Table of Contents
List of Exhibits
Chapter 9: Computer Crime Policy and Programs...............................................................338
Chapter 11: Privacy Issues in the High−Tech Context........................................................338
Chapter 12: Critical Infrastructure Protection.......................................................................339
Chapter 13: Electronic Commerce: Legal Issues.................................................................339
Chapter 14: Legal Considerations in Designing and Implementing Electronic
Processes: A Guide for Federal Agencies..........................................................................339
Chapter 18: How to Report Internet−Related Crime............................................................339
vi
Cyber Forensics—A Field Manual for Collecting,
Examining, and Preserving Evidence of Computer
Crimes
ALBERT J. MARCELLA, Ph.D.
ROBERT S. GREENFIELD Editors
AUERBACH PUBLICATIONS A CRC Press Company
Boca Raton London New York Washington , D.C.
Library of Congress Cataloging−in−Publication Data
Cyber forensics: a field manual for collecting, examining, and preserving evidence of
computer crimes / Albert J. Marcella, Robert Greenfield, editors.
p. cm.
Includes bibliographical references and index.
ISBN 0−8493−0955−7 (alk. paper)
1. Computer crimes−−Investigation−−Handbooks, manuals, etc. I. Marcella, Albert J. II. Greenfield,
Robert, 1961−
HV8079.C65 C93 2001
363.25'968−−dc21
2001053817
This book contains information obtained from authentic and highly regarded sources. Reprinted
material is quoted with permission, and sources are indicated. A wide variety of references are
listed. Reasonable efforts have been made to publish reliable data and information, but the authors
and the publisher cannot assume responsibility for the validity of all materials or for the
consequences of their use.
Neither this book nor any part may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying, microfilming, and recording, or by any information
storage or retrieval system, without prior permission in writing from the publisher.
All rights reserved. Authorization to photocopy items for internal or personal use, or the personal or
internal use of specific clients, may be granted by CRC Press LLC, provided that $1.50 per page
photocopied is paid directly to Copyright clearance Center, 222 Rosewood Drive, Danvers, MA
01923 USA The fee code for users of the Transactional Reporting Service is ISBN
0−8493−0955−7/02/$0.00+$1.50. The fee is subject to change without notice. For organizations that
have been granted a photocopy license by the CCC, a separate system of payment has been
arranged.
1
The consent of CRC Press LLC does not extend to copying for general distribution, for promotion,
for creating new works, or for resale. Specific permission must be obtained in writing from CRC
Press LLC for such copying.
Direct all inquiries to CRC Press LLC, 2000 N.W. Corporate Blvd., Boca Raton, Florida 33431.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and
are used only for identification and explanation, without intent to infringe.
Visit the Auerbach Publications Web site at www.auerbach−publications.com
Copyright © 2002 by CRC Press LLC
Auerbach is an imprint of CRC Press LLC
No claim to original U.S. Government works
International Standard Book Number 0−8493−0955−7
Library of Congress Card Number 2001053817
Printed in the United States of America 1 2 3 4 5 6 7 8 9 0
Printed on acid−free paper
Editors and Contributors
Albert J. Marcella, Jr., Ph.D., CFSA, COAP, CQA, CSP, CDP, CISA, is an associate professor of
Management in the School of Business and Technology, Department of Management, at Webster
University, in Saint Louis, Missouri. Dr. Marcella remains the president of Business Automation
Consultants, an information technology and management−consulting firm he founded in 1984. Dr.
Marcella has completed diverse technical security consulting engagements involving disaster
recovery planning, site and systems security, IT, financial and operational audits for an international
clientele. He has contributed numerous articles to audit−related publications and has authored and
co−authored 18 audit−related texts.
Robert S. Greenfield, MCP, has over 16 years of experience as a programmer/analyst, with the
past five years as a systems consultant and software engineer in the consulting field. He has
extensive experience designing software in the client/server environment. In addition to mainframe
experience on several platforms, his background includes systems analysis, design, and
development in client/server GUI and traditional environments. His client/server expertise includes
Visual Basic, Access, SQL Server, Sybase, and Oracle 7.3 development. Mr. Greenfield has
created intranet Web sites with FrontPage and distributing applications via the Internet. He currently
holds professional accreditation as a Microsoft Certified Professional and continues self paced
training to achieve MCSE, MCSD, and MCSE/D + Internet ratings.
Abigail Abraham is an Assistant State's Attorney, prosecuting high−technology crimes for the Cook
County State's Attorney's Office in Chicago, Illinois. She was awarded her J.D. from The University
of Chicago Law School and served as an editor on the law review. Following law school, she
clerked for one year for the Honorable Danny J. Boggs, U.S. Court of Appeals for the Sixth Circuit.
She is an adjunct law professor at The University of Chicago Law School. In addition, she has
designed training for lawyers and for police officers, and lectures around the country on
2
high−technology legal issues.
Brent Deterdeing graduated from the University of Missouri with a degree in computer science and
a minor in economics. Brent's involvement with SANS is extensive. He is an author of an upcoming
book on firewalls through SANS, as well as chairing the SANS/GIAC Firewalls Advisory Board. He
has mentored both small and large classes through SANS/GIAC Security Essentials Training &
Certification (GSEC). Brent also authors, revises, and edits SANS courseware, quizzes, and tests.
He has earned the SANS/GIAC GSEC (Security Essentials), GCFW (Firewall Analyst — HONORS),
GCIA (Intrusion Analyst), and GCIH (Incident Handling) certifications, as well as being a Red Hat
Certified Engineer (RHCE). Brent participates in the St. Louis InfraGard chapter.
John W. Rado is a geospatial analyst at National Imagery and Mapping Agency (NIMA) in St.
Louis, Missouri. John has worked for NIMA since January of 1991.
William J. Sampias has been involved in the auditing profession for the past decade, with primary
emphasis on audits of information systems. Mr. Sampias has published several works in the areas
of disaster contingency planning, end−user computing, fraud, effective communications, and
security awareness. Mr. Sampias is currently director of a state agency information systems audit
group.
Steven Schlarman, CISSP, is a security consultant with PricewaterhouseCoopers. Since joining
the firm in 1998, Steve has covered a number of roles, mainly as the lead developer of the
Enterprise Security Architecture System and Services. He has published articles on the subject as
well as being one of the major thought leaders in the PricewaterhouseCoopers' Enterprise Security
Architecture Service line. Prior to joining the firm, Steve had worked on multiple platforms including
PC applications, networking, and midrange and mainframe systems. His background includes
system security, system maintenance, and application development. Steve has completed
numerous technical security consulting engagements involving security architectures, penetration
studies ("hacking studies"), network and operating system diagnostic reviews, and computer crime
investigation. He has participated in both PC computer forensic analysis and network intrusion
management and investigation. Prior to PricewaterhouseCoopers, Steve worked at a U.S. state law
enforcement agency in the information systems division.
Carol Stucki is working as a technical producer for PurchasePro.com, a rapidly growing dot.com
company that is an application service provider specializing in Internet−based procurement. Carol's
past experiences include working with GTE, Perot Systems, and Arthur Andersen as a programmer,
system analyst, project manager, and auditor.
Dedication
Erienne, Kristina, and Andy
Michael Jordan said it best, thus, what more can I say…
I approached practices the same way I approached games. You can't turn it on and
off like a faucet. I couldn't dog it during practice and then, when I needed that extra
push late in the game, expect it to be there. But that's how a lot of people fail. They
sound like they're committed to being the best they can be. They say all the right
things, make all the proper appearances. But when it comes right down to it, they're
looking for reasons instead of answers. If you're trying to achieve, there will be
roadblocks. I've had them; everybody has had them. But obstacles don't have to stop
you. If you run into a wall, don't turn around and give up. Figure out how to climb it,
3
go through it, or work around it.
You are each important, special and unique for so many reasons. Always remain close, protect,
respect, and love each other. Always know that I love each of you with all my heart.
Thank you Diane, for your constant support and love. My life is a far better one with you in my
world. Today, tomorrow, forever…
Al
This book is dedicated to my mother and father who always believed in me, gave me love,
guidance, and support in all of my pursuits. A son could not hope for better parents. Thank you both
and know that your love gives me strength every day.
To my wife for her patience, and love through it all. And a special thank you goes out to my
daughter Hannah, for your understanding, patience, love, wit, and unwavering support.
You are all the best and I love you.
I also would like to recognize Dr. Marcella for giving me this opportunity. Thank you.
Bob
Acknowledgments
As senior editor for this text, the responsibility to acknowledge and thank all the individuals who
have contributed their expertise, time, energies, and efforts to the successful development of this
text falls to me. This is no easy task. It is difficult to put into words the appreciation and gratitude I
have for each of their efforts and to express appropriately to each of them my sincere thanks for
giving their time and themselves to make this text a better product. Simply mentioning each by
name here seems a bit inadequate in comparison to their individual and collective contributions.
Given the continual shifting technological landscape in which we all live and work, attempting to
harness even for a moment in time, this very technology, and to "look under the hood" so−to−speak,
was a daunting assignment. Those professionals whose insights and comments on the critically
important field of cyber forensics are included in this text, and deserve substantial credit and our
thanks for taking up this challenge and for their spot−on examination and evaluation of key cyber
forensics issues.
I wish to formally recognize each contributing author here, although briefly, and have included a
more extensive personal profile for each author. To each of you, please know that you have my
heartfelt gratitude and personal thanks for your willingness to contribute your talents and expertise
to this text.
Thank You:
To my co−editor Bob Greenfield; thank you for contributing your talents in the technical systems
arena and for your piece on "The Liturgical Forensic Examination: Tracing Activity on a
Windows−Based Desktop."
Thanks to Steve Schlarman, security consultant at PricewaterhouseCoopers, who wrote the chapter
on "Network Intrusion Management and Profiling," and to Brent Deterdeing, network security
4
manager, enabling technologies at Solutia, Inc., for insights and comments on "Tools of the Trade:
Automated Tools Used to Secure a System Throughout the Stages of a Forensic Investigation."
John Rado, geospatial analyst at National Imagery and Mapping Agency; thank you for sharing your
thoughts (and your extensive security/forensics background and library with me), and for developing
the focused piece on "Basics of Internet Abuse: What is Possible and Where to Look Under the
Hood."
From the Financial and Computer Crime Department of the State Attorney's office of Cook County,
Illinois, Attorney Abigail Abraham; thank you for your engaging examination into "Cyber Forensics
and the Legal System."
To my long−time colleagues and collaborators Carol Stucki, for your presentations on the "The Goal
of the Forensic Investigation" and "How to Begin a Nonliturgical Forensic Examination;" and Bill
Sampias for your efforts in developing the areas of guidelines and tools, including the list of critical
recommended readings.
Additionally, I would like to thank Carol for all the work she did in compiling the exhaustive reference
materials from the Federal Bureau of Investigation, computer examinations library, which appeared
in successive issues of the Bureau's Handbook of Forensic Services.
Without the contributions of these talented professionals, this text would have been a lesser
product.
Last, but by far certainly not the least, I want to acknowledge and thank Christian Kirkpatrick,
Acquisitions Editor at Auerbach Publications, for her constant confidence that this text would
emerge from a simple concept into a viable product.
Christian, thank you for your steadfast support throughout the lengthy development process that
has led to the creation of this viable cyber forensics field manual.
5
Disclaimer
As always with texts of this nature, here is the disclaimer….
The information contained within this field manual is intended to be used as a reference, and not as
an endorsement of the included providers, vendors, and informational resources. Reference herein
to any specific commercial product, process, or service by trade name, trademark, service mark,
manufacturer, or otherwise does not constitute or imply endorsement, recommendation, or favoring
by the authors or the publisher.
As such, users of this information are advised and encouraged to confirm specific claims for product
performance as necessary and appropriate.
The legal/financial materials and information that are available for reference through this manual are
not intended as a substitute for legal/financial advice and representation obtained through
legal/financial counsel. It is advisable to seek the advice and representation of legal/financial
counsel as may be appropriate for any matters to which the legal/financial materials and information
may pertain.
Web sites included in this manual are intended to provide current and accurate information; neither
the authors, publisher, nor any of its employees, agencies, and officers can warranty the information
contained on the sites and shall not be held liable for any losses caused on the reliance of
information provided. Relying on information contained on these sites is done at one's own risk. Use
of such information is voluntary, and reliance on it should only be undertaken after an independent
review of its accuracy, completeness, efficacy, and timeliness.
Throughout this manual, reference links to other Internet addresses have been included. Such
external Internet addresses contain information created, published, maintained, or otherwise posted
by institutions or organizations independent of the authors and the publisher. The authors and the
publisher do not endorse, approve, certify, or control these external Internet addresses and do not
guarantee the accuracy, completeness, efficacy, timeliness, or correct sequencing of information
located at such addresses. Use of such information is voluntary, and reliance on it should only be
undertaken after an independent review of its accuracy, completeness, efficacy, and timeliness.
6
Introduction
As an auditor as well as researcher and author, I realize and value the importance of timely,
well−focused, accurate information. It is with this philosophy in mind that the development of this
project was undertaken.
To the reader, a note of explanation…. This is not a text, but rather a field manual. It has been
written — better yet, compiled — and edited in a manner that will allow you to rapidly access a
specific area of interest or concern and not be forced to sequentially wade through an entire text,
chapter by chapter, to get to what is important to you.
In the true sense of a field manual, each "chapter" (and we use that term loosely) stands on its own
and presents focused, timely information on a specific topic related to cyber forensics. The author of
each "chapter" was selected for his or her expertise in a specific area within the very broad field of
cyber forensics.
Often a limiting aspect of most projects, especially those written on emerging technical topics, is the
inability to cover every aspect of the topic in a single all−inclusive text. This truth befalls this field
manual that you are about to use.
Initial research into this growing discipline proved that it would be next to impossible to include all
the areas of both interest and importance in the field of cyber forensics that would be needed and
required by all potential readers and users in a single text. Thus, this field manual presents specific
and selected topics in the discipline of cyber forensics, and addresses critical issues facing the
reader who is engaged in or who soon will be (and you will!) engaged in the preservation,
identification, extraction, and documentation of computer evidence.
As a user of this field manual, you will see that this manual's strength lies with the inclusion of an
exhaustive set of chapters covering a broad variety of forensic subjects. Each chapter was
thoroughly investigated; examined for accuracy, completeness, and appropriateness to the study of
cyber forensics; reviewed by peers; and then compiled in a comprehensive, concise format to
present critical topics of interest to professionals working in the growing field of cyber forensics.
We finally had to select several key areas and put pen to paper, entice several colleagues to share
their ideas, and resign ourselves to the fact that we cannot say all that needs to be said in one text,
book, or manual. We trust the material we have included will serve as a starting point for the many
professionals who are beginning their journey into this exciting discipline.
We begin our journey into the realm of this relatively new discipline by opening with a brief
discussion as to the current state of the environment relating to the need for this new field of
forensics and then a brief examination of the origins of cyber forensics. Along the way, we will
establish several basic definitions designed to assist the reader in moving easily through what could
be difficult and confusing terrain.
Although e−mail is becoming more mission−critical for enterprises, it also has the
ability to haunt a company in times of trouble, because records of e−mail messages
remain in the company systems after deletion — a feature highlighted during the
Microsoft anti−trust trial. The case has featured critical testimony derived from old
Microsoft e−mail messages.
—InfoWorld, 10/25/99
7
Background
The ubiquitous use of computers and other electronic devices is creating a rapidly rising wave of
new and stored digital information. The massive proliferation of data creates ever−expanding digital
information risks for organizations and individuals. Electronic information is easy to create,
inexpensive to store, and virtually effortless to replicate. As a result, increasingly vast quantities of
digital information reside on mass storage devices located within and without corporate information
systems. Information risks associated with this data are many. For example, electronic data can
often show — with a high degree of reliability — who said, knew, took, shared, had and did what,
and who else might be involved in the saying, knowing, taking, sharing, having, and doing. For the
corporation, the free flow of digital information means that the backdoor is potentially always open to
loss.
To put the explosive growth of electronic data in perspective, consider that Americans were
expected to send and receive approximately 6.8 trillion e−mail messages in 2000 — or about 2.2
billion messages per day. [1] Although some of this e−mail is sent and received by individuals, most
of it is being created by and sent from corporate mail servers.
In 2000, the World Wide Web consisted of 21 terabytes of static HTML pages and is growing at a
rate of 100 percent per year. [2] There are now about 2.5 billion indexed Web pages, increasing at
the rate of 7.3 million pages per day.
Demand for digital storage is expected to grow by more than 1800 percent between 1998 and 2003.
A midrange estimate of the amount of data currently stored on magnetic tape is 2.5 exabytes (an
exabyte is 1 million terabytes), with another 2.5 exabytes stored on computer hard drives. [3]
Contrasting the growth of paper pages and electronic documents adds additional perspective. The
growth of recorded information doubles every three to four years. Over 93 percent of all information
produced in 1999 was in digital format. About 80 percent of corporate information currently exists in
digital form. Companies are expected to generate some 17.5 trillion electronic documents by 2005,
up from approximately 135 billion in 1995. [4] Some 550 billion documents now exist online.
There is more to this explosive growth than just "documents." Additional forms of electronic data
originate from:
• Internet−based electronic commerce, online banking, and stock trading
• Corporate use and storage of phone mail messages and electronic logs
• Personal organizers, such as the Palm Pilot (worldwide PDA sales were expected to total
about 6 million units in 2000 rising to 17 million in 2004.)
• Wireless devices such as cell phones and pagers with contacts and task list storage
(worldwide mobile phone sales were expected to total about 400 million in 2000, rising to
560 million in 2004 [5])
• Digital cameras
• Corporate use and storage of graphic images, audio, and video
These are several of the factors now at work in corporations that increase the risk of litigation and
loss of confidential corporate data (from www.fiosinc.com/digital_risk.html, Fios, Inc. (877)
700−3467, 921 S.W. Washington Street, Suite 850, Portland, Oregon 97205)
It is best to state up−front that the emphasis in any cyber forensic examination must be on the
forensic element, and it is vital to understand that forensic computing, cyber forensics, or computer
forensics is not solely about computers. It is about rules of evidence, legal processes, the integrity
8
and continuity of evidence, the clear and concise reporting of factual information to a court of law,
and the provision of expert opinion concerning the provenance of that evidence:
Companies are very concerned about the notion that anything they write
electronically can be used again at any time. If you have to discipline yourself to
think, "can this be misconstrued?" that greatly hampers your ability to communicate
and introduces a huge level of inefficiency.
—David Ferris, president of Ferris Research (San Francisco)
[1]
University of California at Berkeley, School of Information Management and Systems, October
2000, http://www.sims.berkeley.edu/how−much−info/.
[2]
University of California at Berkeley, School of Information Management and Systems, October
2000, http://www.sims.berkeley.edu/how−much−info/.
[3]
University of California at Berkeley, School of Information Management and Systems, October
2000, http://www.sims.berkeley.edu/how−much−info/.
[4]
Designing a Document Strategy: Documents…Technology…People. Craine, K., MC2 Books,
2000.
[5]
University of California at Berkeley, School of Information Management and Systems, October
2000, http://www.sims.berkeley.edu/how−much−info/.
Dimensions of the Problem
Crime: an act committed in violation of the law.
Much of today's computer−related crime is not a violation of formal law. In 1979, the Justice
Department defined computer crime as any illegal act for which knowledge of computer technology
is essential for its perpetration, investigation, or prosecution.
Criminal law is a crime, which is a wrong against society, typically leading to a conviction, which
normally results in jail term or probation. The main purpose is punishment of the offender. Most
computer crimes in United States today go unpunished (which weakens deterrence of law).
Evidence must be gathered by law enforcement in accordance with court guidelines governing
search and seizure (Fourth Amendment):
The right of the people to be secure in their persons, houses, papers, and effects,
against unreasonable searches and seizures, shall not be violated, and no warrants
shall issue, but on probable cause, supported by oath or affirmation, and particularly
describing the place to be searched, and the persons or things to be seized.
Computer crime is escalating!
The FBI's caseload is increasing dramatically. In FY 1998, the FBI opened 547 computer intrusion
cases; in FY 1999, that jumped to 1154. At the same time, because of opening the National
Infrastructure Protection Center (NIPC) in February 1998 and the FBI's improving ability to fight
cyber crime, the Bureau closed more cases. In FY 1998, the closed case file increased to 399
intrusion cases; and in FY 1999 it increased to 912 such cases.
However, given the exponential increase in the number of cases opened, cited above, the FBI's
actual number of pending cases has increased by 39 percent, from 601 at the end of FY 1998 to
834 at the end of FY 1999. In short, although the FBI has markedly improved its capabilities to fight
cyber intrusions, the problem is growing even faster.
9
The Computer Security Institute released its fifth annual "Computer Crime and Security Survey" for
2001, confirming the alarming facts cited above. Eighty−five percent of respondents detected
security breaches over the past 12 months.
At least 64 percent of respondents reported financial losses, including theft of proprietary
information, financial fraud, system penetration by outsiders, data or network sabotage, and
denial−of−service attacks. Information theft and financial fraud caused the most severe financial
losses, put at $151 million and $93 million, respectively. The losses from 186 respondents totaled
just over $377 million.
Losses traced to denial−of−service attacks were only $77,000 in 1998, and by 1999 had risen to
just $116,250. Further, the new survey reports on numbers taken before the high−profile February
2000 attacks against Yahoo!, Amazon, and eBay. Finally, many companies are experiencing
multiple attacks; 19 percent of respondents reported ten or more incidents.
Attorney Deanne Siemer says she tells judges that digital technology "takes
one−third out of the trial time." And that's a huge factor for courts with their enormous
backlogs.
— Rebecca Ganzel,
"Digital Technology in the Courtroom,"
Presentations, November 1999
Computer Forensics
Computer Forensics deals with the preservation, identification, extraction, and documentation of
computer evidence. The field is relatively new to the private sector but it has been the mainstay of
technology−related investigations and intelligence gathering in law enforcement and military
agencies since the mid−1980s.
Like any other forensic science, computer forensics involves the use of sophisticated technology
tools and procedures that must be followed to guarantee the accuracy of the preservation of
evidence and the accuracy of results concerning computer evidence processing.
What evidence is needed?
• All physical evidence (computer, peripherals, notepads, documentation, etc.)
• Visual output on the monitor
• Printed evidence on a printer
• Printed evidence on a plotter
• Film recorder (magnetic representations)
It is extremely important to realize that evidence must have been gathered in accordance with the
Fourth Amendment and the Electronic Communications Privacy Act (ECPA), and that
computer−generated evidence is considered "hearsay" with some exclusions. Depending on your
role or responsibility in the computer forensics investigation, you may be subject to differing sets of
rules and regulations. Internal investigators, for example, are not subject to the Fourth Amendment
stipulations; however, they are subject to the ECPA.
Typically, computer forensic tools exist in the form of computer software. Computer forensic
specialists guarantee accuracy of evidence processing results through the use of time−tested
10
evidence processing procedures and through the use of multiple software tools, developed by
separate and independent developers. The use of different tools that have been developed
independently to validate results is important to avoid inaccuracies introduced by potential software
design flaws and software bugs.
The introduction of the personal computer in 1981 and the resulting popularity came with a mixed
blessing. Society in general benefited, but so did criminals using personal computers in the
commission of crimes. Today, personal computers are used in every facet of society to create and
share messages, compute financial results, transfer funds, purchase stocks, make airline
reservations, and access bank accounts and a wealth of worldwide information on essentially any
topic.
Computer forensics is used to identify evidence when personal computers are used in the
commission of crimes or in the abuse of company policies. Computer forensic tools and procedures
are also used to identify computer security weaknesses and the leakage of sensitive computer data.
In the past, documentary evidence was typically stored on paper and copies were made with carbon
paper or photocopy machines.
Most documents are now stored on computer hard disk drives, floppy diskettes, Zip disks, and other
forms of removable computer storage media. Computer forensics deals with finding, extracting, and
documenting this form of "electronic" documentary evidence (www.forensics−intl.com/def4.html).
Along the way, prior to formally pursuing a cyber forensics investigation, several important and
critical questions must be asked:
• What is the policy in the organization to report and deal with computer crime? (It may be
nonexistent, or it may be not well thought out or tested, or it may even be incompetent.)
• Do you "really" want to prosecute?
• Who do you call in law enforcement and what will be their reaction?
Additional questions that should be considered and appropriate answers well thought out include:
• Can you afford to be without the evidence?
• Are you willing to see this go public?
• Was a thorough investigation conducted?
• Did you violate the ECPA or any privacy issues?
• How will you prove the crime?
• Is there any likelihood of the suspect doing damage prior to arrest? (Dr. Rayford Vaughn,
)
Obtaining concrete answers to these questions prior to embarking on a cyber forensics audit or
investigation is critical. Doing so may help shield the organization (as well as the
investigator/auditor/security personnel, etc.) from civil or criminal liabilities.
The material presented in the following pages of this field manual has been selected, developed,
and shared with the specific objective of providing the reader with a resource with which to become
better prepared to undertake and participate in the cyber forensics audit of a suspect system.
Works Cited
1. University of California at Berkeley, School of Information Management and Systems, October
2000, http://www.sims.berkeley.edu/how−much−info/.
11
2. Designing a Document Strategy: Documents…Technology…People. Craine, K., MC2 Books,
2000.
12
Section I: Cyber Forensics
Chapter List
Chapter 1: The Goal of the Forensic Investigation
Chapter 2: How to Begin a Non−Liturgical Forensic Examination
Chapter 3: The Liturgical Forensic Examination: Tracing Activity on a Windows−Based Desktop
Chapter 4: Basics of Internet Abuse: What is Possible and Where to Look Under the Hood
Chapter 5: Tools of the Trade: Automated Tools Used to Secure a System Throughout the Stages
of a Forensic Investigation
Chapter 6: Network Intrusion Management and Profiling
Chapter 7: Cyber Forensics and the Legal System
13
Chapter 1: The Goal of the Forensic Investigation
Overview
Carol Stucki
Any investigation has a purpose. With this chapter we will start with the reasons why one would
need to conduct an investigation involving computers. When we understand the reason why we are
conducting the investigation, then we can develop a plan of action on how to conduct that
investigation, and where to look for evidence. The information gathered during the investigation can
be used for the enforcement of Human Resources (HR) rules for disciplinary action and even legal
action. Therefore, the reasons for the investigation are almost as important as the investigation
itself.
This chapter reviews several reasons why an investigation is needed and the plan of that
investigation, based on those reasons. It also reviews the impact of the action that resulted in the
complaint. We first need to determine the impact or feasibility of conducting the investigation. For
example, if the cost of the investigation outweighs the benefits, there might not be a reason to
conduct the investigation. For the most part, the decision to conduct the investigation is up to
management. However, it is the investigators' responsibility to provide the information on which to
allow management to base the decision to proceed.
The deliverables from this chapter will be either a recommendation to proceed with the investigation
and a plan of action to do so, or to withdraw due to a lack of evidence or justification. With the plan
in hand, you will be able to take the steps outlined in the following chapters to implement the
investigation. You will actually conduct the investigation and use the tools as described to gather the
information and evidence needed to reach a conclusion in your investigation.
Why Investigate
First we will need to consider the complaint or the initial reason for conducting an investigation.
Some typical reasons that may warrant an investigation include but are not limited to:
• Internet usage exceeds norm
• Using e−mail inappropriately
• Use of Internet, e−mail, or PC in a non−work−related manner
• Theft of information
• Violation of security policies or procedures
• Intellectual property infractions
• Electronic tampering
This chapter reviews the typical reasons for investigation and lists some questions to help
determine what facts or circumstances surround each reason.
Internet Exceeds Norm
If the complaint is that someone's Internet usage is too high, we should first determine the basis for
this complaint. It should also be determined whether the above normal Internet usage was identified
14
through electronic monitoring or by personal observation. It is also appropriate to determine if the
usage is out−of−line with company standards for the type of job responsibilities held by the
individual under investigation. Equally important is to determine how those standards were
determined and developed.
There are different questions to be asked, and answered, in order to investigate the claim,
depending on the basis of the complaint.
If the usage was electronically monitored:
1. Did a firewall monitor the usage?
2. Was the usage monitored by Internet Protocol (IP) address or individual identification (ID)?
3. What exactly was monitored? (e.g., time, sites, keywords, etc.)
4. Can more than one person use this personal computer (PC) (or IP address)?
5. Can more than one person use this ID?
6. Can the usage times/dates be correlated to physical access by the individual under
investigation? (If monitoring shows access was between 8 a.m. and 10 a.m., was the
individual at work during this time?)
7. What was the pattern of access?
8. How does this compare with the individual's work schedule?
9. Could the individual have logged in and then not logged out? (i.e., get to an Internet site and
then go to another task on the PC, thus leaving the Internet site up and running?)
10. Are there timeouts set on the Internet access? On the PC login?
11. Are there security cameras, login sheets, key card access logs, or timecards that can verify
that it was the individual who accessed the Internet via this PC?
12. Is there a pattern to the usage?
Once you obtain answers to these questions you will begin to see the outlines of a plan of the
investigation forming. For example, if Joe Programmer is accused of exceeding Internet norms,
based on a report generated from the firewall monitoring system, we can ask some additional
questions to validate the concern/ complaint.
If the pattern of unusually high utilization was after−hours when Joe was not scheduled to be at
work, then there might be a deeper issue that will require further investigating to uncover (i.e., who
and how someone was using Joe's ID after−hours). However, if the case is simply that Joe is
logging into the Internet first thing in the morning to check the latest news or stock quotes, and not
logging out, this is a case where the monitoring or rules might need to be adjusted to account for the
high usage. Alternatively, Joe may simply need a refresher course on the company's Internet usage
policies.
On the other hand, if the usage concern was based on a person's observation of Joe's actions,
there is another, slightly different set of questions to ask, such as:
1. Who made the observation?
2. Are logs available to support the observation? (e.g., login, logout, timecards, firewall access,
etc.)
3. Are there other witnesses to support the observation?
4. What exactly was the individual under investigation observed doing?
5. What is the pattern of usage?
6. Are there security cameras, login sheets, time cards, or key card access logs that can verify
the individual under investigation had access and was logged on to the Internet?
15
Again, once you obtain answers to these questions you will begin to formalize a plan of
investigation. This plan will differ slightly from the plan based on electronic monitoring. With
observation being the basis for a complaint, the ability to verify the usage is more difficult to
substantiate — but not impossible.
There are a variety of tools, methods, and techniques outlined in this text that will allow you to
substantiate the claim, if there is any evidence. For example, there are several files located on the
firewall and the PC that can be retrieved, displayed, and reviewed in order to prove or disprove the
above−normal access violation(s).
The above−normal utilization should prompt the investigator and management to inquire about the
impact (financial, physical, operational, etc.) of the so−called excessive usage. Several questions to
help evaluate the impact include:
1. What damage (if any) did the excessive usage cause?
2. How can the damage be substantiated?
3. How can the damage be quantified?
4. Did the individual under investigation not meet his or her job responsibilities as a result of
excessive Internet usage?
5. Did the individual under investigation interfere with another person's job performance as a
result of the excessive utilization?
6. Was someone offended by the usage (e.g., inappropriate materials, games being played)?
7. Can you identify this person?
8. Is the person willing to state for the record that he or she she was offended by the usage?
9. Did fraud occur in the form of falsified timesheets — hours of work reported, or any other
form, as a result?
The answers to these questions answers will not only help form the plan for this type of
investigation, but will also help the investigator and management determine if the investigation
should be (can be) pursued.
Inappropriate E−mail
Before performing any investigation on e−mail, you need to ensure that corporate policy allows it.
New electronic privacy laws protect the privacy of electronic communications. If corporate policy
specifically states that all computers and data stored on them belong to the corporation, then you
are probably on safe ground. Be sure that there is such a policy and that the employee under
investigation has read the policy before proceeding. Although this is one of the easiest
investigations, this type of investigation should be done strictly by the book. If the corporate policy
does not contain the rights to the employee's e−mail, then you and your corporation could be
subject to a lawsuit for invading the privacy of an employee.
If the reason for an investigation is that there was inappropriate use of e−mail, either through the act
of sending offensive material or for personal and non−work−related use, there is yet another set of
questions that should be asked. These questions will help determine if there was inappropriate
utilization of the company's e−mail systems and if further investigative action is required.
1. What was sent?
2. Can you obtain a copy from the complainant or recipient?
3. Is a copy available from the automated e−mail archive system?
4. Was someone offended? (This could be an harassment issue and require HR involvement.)
16
5. Who if anyone else received the material?
6. Was the individual under investigation the originator of the e−mail, or was it someone else?
7. How were you able to (or can you) validate this?
8. Could someone else have sent the e−mail, using the ID of the individual under investigation?
9. Are screen−saver passwords used?
10. Could someone else use the PC of the individual under investigation?
11. Was the time that the e−mail was sent during the time the individual under investigation had
access to e−mail?
12. Is auto−forwarding of e−mail used? Available? Activated?
13. Was a group list used?
14. Are there patterns or history to the e−mail usage?
15. Have there been previous warnings to the individual under investigation about the e−mail
usage?
16. If so, are these warnings documented?
17. What was the intent of the e−mail?
Some of the questions listed in the section on abnormal Internet utilization can also be applied to
this type of investigation. The real issue with this type of investigation is to determine whether it is
an issue of harassment or a case of violating company e−mail policies/procedures.
Potential exposures to the company, which can result from the lack of a proactive response by
management to a harassment complaint, include a lawsuit filed against the company by the
complainant, as well as multiple instances of harassment that can lead to multiple lawsuits.
Furthermore, to make matters worse, the longer the company waits to investigate, the more likely it
is that lawyers will have a field day and turn this into the company not caring, and thus higher
rewards to the complainant. To alleviate the appearance of a non−proactive response to
harassment complaints, the company should have anti−harassment policies and training programs.
This training should be repeated annually for all employees. There should be documentation that is
maintained in HR files stating that each employee has attended and signed a statement that he or
she has read the company's policies against harassment. This is also documentation that should be
gathered during the investigation.
Non−Work−Related Usage of Company Resources
If the reason for the investigation is about non−work−related use of company resources (i.e., PC,
e−mail, or access to the Internet), the above questions apply, but there are additional questions that
should be asked, including:
1. What exactly occurred? (Was the individual under investigation using his or her PC to
engage in "moonlighting" work, e−mail for personal use, etc.?)
2. When did the incident occur?
3. How was it documented?
4. How often or how much does this happen?
5. Is the individual under investigation the only person engaged in this activity, or are there
others?
6. How can you determine this?
7. Is the action a widely accepted company practice, albeit a violation of company policy?
8. Did the individual under investigation take the action for personal financial gain?
9. Was the non−work−related usage for personal use?
10. Is there a liability to the company due to the unauthorized use of company property?
17
These more detailed questions will help frame the direction of the investigation more clearly. Thus,
a more appropriate plan of action can be devised and carried out. The main issue with this type of
investigation concerns the inappropriate use of company property for personal gain, and whether
the inappropriate usage violated any standing company policies.
Theft of Information
The theft of information raises the intensity and seriousness of an investigation to levels that may
exceed those established in previously discussed scenarios. The intensity of an investigation into
the theft of information will vary, depending on what type of information was stolen, its significance
to the company's ability to remain competitive, the nature and sensitivity of the information stolen,
and what was done with the stolen information.
Some of the previously mentioned questions can be applied to this type of investigation. However,
there are additional questions that relate specifically to the theft of information, including:
1. What type of information was stolen?
2. How has this been (or can this be) verified?
3. How much information was stolen?
4. How was the information stolen?
5. What is the impact or cost of the loss?
6. How can this loss be quantified?
7. How can this be substantiated?
8. Is the cost of the loss tangible or intangible (competitive information can be intangible)?
9. Has the goodwill of the company been damaged as a result of the theft?
10. Has the company lost a competitive edge due to the theft?
11. Was the information totally lost (e.g., copied and then erased or destroyed), or was it
copied?
12. Was another company's information, beyond your own, compromised?
13. What was the level of security surrounding the information lost?
14. Who had access to the stolen information?
15. Can this be verified?
16. Are access logs available?
17. Are they free from potential, external tampering?
18. Were there procedures in place for the safe handling/accessing of the lost information?
19. Was the information proprietary, confidential, or restricted?
20. How was this classification determined and communicated?
To determine exactly how the information was stolen, you might need to perform further security
and access audits/reviews. For the purpose of planning and investigation, the investigator should
develop a sense of how the information was stolen. One reason to quickly determine how the
information may have been stolen is an attempt to prevent further information from being stolen in
the same manner.
Violation of Security Parameters
Violation of security parameters can vary widely, from an individual simply failing to properly log off
when leaving work to covert hacking into secured files. Security parameters are not always those
dramatic measures of using guards, secret codes, retinal scanners, and IDs, but they do include the
18
use of security cameras and passwords, and following procedures for handling secure documents.
The violation or misuse of security parameters can lead to the theft or misuse of company
information or property, or worse. Violation of security parameter complaints should begin with
asking the following questions:
1. What security parameters or measures were violated? Note: Care must be exercised in both
asking and documenting the response to this question. Some parameters may be
proprietary while others may be highly sensitive, and their disclosure might jeopardize the
security of entire systems.
2. How were the parameters violated? (See note above.)
3. What was the result of the violation?
4. How can this be substantiated?
5. Were passwords compromised (hacked)?
6. Have new passwords been issued? Reset?
7. Were security measures disabled (e.g., security cameras unplugged, screen savers turned
off, etc.)?
8. Were security measures bypassed?
9. If so, how? (See note in question 1 above.)
10. Was information falsified as part of the violation (e.g., fraud — pretending to be someone
else)?
The violation of security parameters does not always result in the compromise of company
information. However, because the violation of security can lead to the compromise of information, it
is important to investigate every violation.
The investigation can lead management to recognize the need to add more security measures or to
improve existing measures to both secure and protect the company's information.
Intellectual Property Infraction
Intellectual properties are those ideas, techniques, procedures, or program codes that are
considered proprietary and that belong to a specific company. Companies usually have clauses in
their employment contracts that state that any intellectual property developed during an employee's
employment with the organization belongs to the company and cannot be used outside the
organization. Infractions of an organization's intellectual property policies usually involve former
employees, contractors, or consultants, using techniques or code that they created (or had access
to), who are now at a new employer/competitor.
When investigating this type of infraction, the investigator may wish to begin by asking the following
questions:
1. Does the organization require employees involved in or holding specific job responsibilities
to sign an intellectual properties agreement/contract?
2. Are signed policies on file?
3. Does the organization have a viable intellectual properties policy?
4. Is it in force?
5. How can this be verified?
6. When was the intellectual property in question first created for the company?
7. How can this be substantiated?
8. Who developed the intellectual property?
19
9. How can this be verified?
10. When was the intellectual property created or used outside the company, violating the
organization's (and previous employee's) intellectual property agreement?
11. Can this be substantiated?
12. Who is the original owner of the intellectual property?
13. Is this merely a case of plagiarism?
14. Are there copyrights involved?
15. Are there patents involved?
16. What proof is there that the intellectual property in question belongs to the company?
With most intellectual property infractions, it is advisable to seek legal counsel in helping to design
and plan the investigation. The major concern of management is the impact of the infraction. If the
impact is minimal, management may decide that an investigation is not warranted. If, however, the
infraction might place the company at a competitive disadvantage, management may wish to
proceed with the investigation.
Competent legal counsel may advise that any and all violations of a company's intellectual
properties policies be investigated and prosecuted to the fullest extent of the law. Failure to do so
(or even to conduct an investigation) might be construed by the courts as indifference, and thus
weaken the company's ability to prosecute future cases.
Electronic Tampering
Electronic tampering can involve fraud, mimicking someone or something (i.e., IP spoofing),
masking, or masquerading as someone (i.e., social engineering). The intent and result of the
tampering is the primary reason to conduct an investigation.
Even if the intent of the tampering involves or can be linked to a noncompetitive prank, there is still
reason to investigate. If any tampering can occur, regardless of the reason, then it should be
prevented to protect the company's information assets.
When investigating electronic tampering, the following questions provide the investigator with a
good starting point. Additionally, the questions listed in the section that addressed the "Violation of
Security Parameters" should also be incorporated into the investigation plan.
1. What was tampered with?
2. How can this be verified?
3. Did the tampering result in the perpetration of a fraud?
4. What was the intent of the tampering?
5. How can this be verified?
6. How was the tampering carried out?
7. Who first noticed the tampering?
8. How was the tampering first identified?
9. Could the tampering have been undertaken in more than one way?
Because some forms of tampering can involve theft or fraud, which can be criminal offenses, legal
counsel should be involved in planning this type of investigation. To determine exactly how the
tampering was performed, it is recommended that the reader examine several of the more
technically specific chapters in this book.
20
We have reviewed some of the questions an investigator can ask and gathered some preliminary
information. We now need to review the basis upon which the complaints were formulated, such as
a violation of company policies, procedures, or legal statutes.
Establishing a Basis or Justification to Investigate
If there is a justification for a specific complaint or reason to investigate, there should also be rules
or a baseline for which the complaint was filed, such as violating a standing company policy or
procedure. For example, if company policies and procedures state that employees should only use
e−mail for company business, this would be the baseline for a complaint about an individual
suspected of using the company's e−mail system for non−work−related activities.
Baselines that guide many complaints (or a justification to investigate) often include a misuse or
violation of:
• Company policies and procedures
• Legal statutes
• Mandatory statutes
• Regulatory statutes
The investigator will need to consult these baselines as appropriate and as part of the investigation
to determine how the baseline(s) apply and if there are any documented penalties for violation of
these baselines. For example, a policy and its associated penalty for sending inappropriate e−mail
could result in the loss of employment for the individual found guilty of violating this policy.
First, consult the company's policies and procedures. There are several different policies and
procedures within the company that should initially be reviewed. For example, Human Resources,
Security, and Employee policies are a good beginning and represent general, most often found
standard policy types in force within most organizations.
As part of investigation planning, consider asking the following questions to learn more about the
company's current policies and procedures (these are especially relevant to investigation of
harassment charges).
1. Are the policies and procedures published and available?
2. Are the policies and procedures current?
3. Are the policies and procedures available in hard or soft copy?
4. Is there mandatory training or orientation to acquaint all employees with these policies and
procedures?
5. Are signatures of the employees gathered to verify that all employees have received and
reviewed these policies?
6. Have there been audits or reviews to verify compliance with policies and procedures?
There are several additional items of documentation that should be considered for examination,
depending on the type of investigation to be undertaken. The investigator should be prepared to ask
for and examine:
• Contracts, both with third−party suppliers and with external consultants
• Non−disclosure agreements, with third−party suppliers and with consultants
21
In addition to company policies and procedures, and contracts, the investigator may find it
appropriate to consult legal statutes if criminal activities are involved. Mandatory statutes refer to
those contracts that the company has with other companies or entities. Those contracts will also
need to be examined in cases of loss of information (data) and the subsequent impact on the
organization. Regulatory statutes will need to be examined when the investigation reveals a
potential for the loss or disclosure of confidential information (data).
Another reason for consulting the legal, mandatory, and regulatory statutes is to determine the
liabilities to the company if no investigation is conducted, when a breach of company security and or
policy occurs. For example, if a fraud were to be perpetrated and the company knew about it but
does not pursue or report it, the company could be held liable for damages resulting from the fraud.
The company could also face penalties for not reporting the fraud.
Determine the Impact of Incident
Once both the reasons for an investigation and the baseline have been determined, we must now
determine the impact of the incident. By understanding the impact, we can determine if it is feasible
to continue on with the investigation. By their very nature, some incidents, regardless of the impact
(financial or otherwise) will need to be investigated.
Some items to keep in mind when determining the impact include, but are not limited to:
• Benefits to pursue such an investigation
• Liabilities for not pursuing an investigation
• Obligations to pursue or not to pursue (goodwill toward public, partners, and other contracts)
• Resources available (time, people, finances, tools, etc.)
To perform an impact review, you will need to plan your investigation. First, you should review why
you are conducting the investigation. For illustration, let us assume that the complaint was that
someone was sending inappropriate e−mail. For planning sake, you know you will need to talk to
several people; namely, the person who filed the complaint, the person under investigation, the
network administrator, the supervisors, and a representative from human resources (HR), as well as
your legal department. So, you will need to allot time to speak with each of these individuals. You
will need to gather their statements as well as evidence along the way. While speaking with HR and
with the supervisors, you will need to gather the company policies and procedures on e−mail,
harassment, and any training programs specifically aimed at workplace harassment. You might
even need to talk with the auditors to see what kinds of audits they have conducted in the HR
department and networking areas to date. (reference audit checklists, list of questions to ask,
samples of HR policies).
The second step, now that you have planned interviews and gathered the appropriate
documentation, is to draw up a timeline. You should also consider what resources will be available
to you in conducting this investigation. Those resources can include personnel in your group and
those external to your department/group. In your consideration, you need to know if you have the
authority to ask other departments to help you gather information. Having someone gather
information for you will save you time and effort. This may, however, compromise the independence
of your investigation. Be sure to verify your sources and check with your legal department on the
appropriateness of using external third parties for this type of specialized work.
You will also need to consider what tools you can use to gather information. Various tools aimed at
providing the auditor with access to erased or "hidden" data will be discussed in subsequent
22
chapters of this text.
As an example, and as a means of further discussing the investigation model, we will operate under
the assumption that your organization has (or you have as the auditor/security professional) several
of the tools discussed in this text. We will use these tools to help gather evidence that the individual
under investigation has sent an offensive e−mail.
Because this example takes a look at e−mail as the source of policy infraction (or worse), we might
not need to confiscate any equipment for examination. This is due to the fact that e−mail (for most
organizations) runs on network servers and network or operations personnel maintain these
servers. You must also keep in mind an important question: How do you determine that the e−mail
in question (the one cited as being offensive) was not "planted"? A basic first step for reviewing
e−mail includes gathering all the e−mails sent by the individual under investigation (or the e−mails
sent during a certain time period).
You might need to trace back several days or weeks, looking at e−mail details to see if there is
more than the one e−mail that may have started the complaint. Also, you might need to gather
e−mail from and to other persons involved in the incident (if others were involved or affected). You
can determine whose e−mail you will need to examine by reviewing a copy of the original e−mail
that initiated the complaint. There may be a list of who else was copied on the e−mail. This list is
where you start gathering e−mails. How do you gather the e−mails? Ask the network/operations
personnel to recover the needed e−mails and have them copied to a file you can access. Most
e−mails can be copied to MS Word files in text format.
This step takes a critical "leap of faith" on the part of the auditor/security professional: that the
organization does indeed maintain an e−mail log/file and also archives all e−mail traffic.
Additionally, the issue of independence is raised here once again. If someone other than the
auditor/security professional retrieves these e−mails it is imperative that control be maintained over
the retrieval process to ensure accountability and authenticity of the e−mails retrieved from the log
file.
Now that you have your list of whom to interview, who will help, and how you plan to gather the
evidence, you should be able to put together a timeline with an estimate of hours required for this
part of the investigation. The second half of the investigation previously discussed will depend on
what you find. This is the ambiguous part, the part where you have to hypothesize, theorize, and
even guess at, for planning purposes.
Once again, let us assume the worst−case scenario; you have found one e−mail that contains
inappropriate material. Also assume there are several people involved, that one individual initially
sent the inappropriate e−mail and several additional individuals passed (e−mailed/forwarded) it
around. You will need to review the policies and procedures on the distribution of inappropriate
e−mail (if they exist). You will also need to review the personnel files of the people involved (and
everyone who forwarded the e−mail(s) in question), and determine if they have been through any
company−sponsored harassment training.
The evidence you gathered (for this scenario) will most probably be turned over to HR department
personnel so they can follow through on any disciplinary actions (if warranted) or establish new
policies, procedures, and controls. Do not forget to plan time to document and summarize your
findings. In the worst case, your evidence may be used in a legal case, and not only how you carry
out your investigation but also what you document and how you document evidence could be
critical.
23
A major consideration in your documentation efforts is to record who you talked to, when you talked
to them, what they said, what evidence you gathered, and how you gathered that evidence; and
then to draw your conclusions, all without interjecting personal opinions. Just gather and document
the facts.
Summarize your plan. You have your lists of who to talk to, resources to help, and how long it will
take. Now you might need to consider the benefits and obligations of conducting or not conducting
the investigation. For example, if the investigation will take three weeks with the help of ten people,
this is 1200 person−hours. Put this into dollars by multiplying the average wages per hour by the
total person−hours. If this amount is more than the consequence of a penalty of $1000 in fines
(average wage $20 per hour, total cost $24,000), it might not be cost−effective to conduct this
investigation. However, if the consequence has much higher fines, damage to goodwill, or the
probability of resulting in a lawsuit (as in the case of the inappropriate e−mail), you may conduct the
investigation regardless. Once you have your estimates for the costs and an outline of the benefits
of the investigation, you can now formally present this to management for their go/no−go decision to
proceed with the investigation.
Who to Call/Contact
Who to call/contact depends on the type investigation that will be conducted (e.g., fraud, misuse of
company assets, etc.). In most companies, the department with the most experience in conducting
investigations is the internal audit department (although in some organizations an independent fraud
investigation unit may be in existence, and can be called upon for assistance). This might be the
first contact for help with any investigation. In most cases, you will probably need to contact:
• Internal audit: expertise in conducting investigations, past audit results
• Network/operations: for tracking IP addresses, e−mails, log files, backup files, monitoring
logs, incident reports
• Data security: policies and procedures, password usage, security reports, log files, access
requests and reports
• Physical security: policies and procedures, after−hours logs to work areas, security camera
tapes, key card access logs, access requests, incident reports
• Human resources: policies and procedures, employee information, complaint reports
• Legal: contracts, legal assistance, mandatory, statutory, legal requirements
• External consultants: in area of needed expertise
And only after serious reflection and consultation with your legal counsel:
• External law enforcement personnel, agencies, or departments
If You Are the Auditor/Investigator
As the auditor/investigator, you will need to determine the following to conduct an effective
investigation:
1. Available resources
2. Authority
3. Obligations/goals
4. Reporting hierarchy
24
5. Escalation procedures
6. Time frame
7. Procedures to follow
8. Precedence of past investigations
9. Independence
Each of these items is discussed as to its importance in conducting an effective investigation.
Resources
You need to know if you are working alone or with a team. A team might be faster but not warranted
for small investigations. With a team you will also need to define who is the leader and who is
responsible for each aspect of the investigation.
Authority
You will need to know what your level of authority is in conducting the investigation. Do you have
access to the information, areas, and resources (not just personnel) you need to effectively conduct
your investigation? Do you have to file requests to gain access? Also, do you have the authority to
quarantine files and equipment? You might need to take someone's PC into your possession for
investigation so you will need to know if you can take it without impacting ongoing operations. You
might also need to know if you have the right to request certain people's time in order to interview
them. If the person you wish to interview is an hourly employee, you might need prior permission
from his or her supervisor.
Obligations/Goals
You need to know what your obligation is, both ethically and professionally, in this company and
with this investigation. If you find that your superior is the individual under investigation, you will
need to know how to handle this investigation. You will need to consider what to do if you uncover
some illegal activity/ action that involves the company, something that if made public could damage
the company's reputation, but if not reported could hurt someone else (as well as being illegal and
misrepresentative). Hopefully, you will not find yourself in an Erin Brokovich "situation."
Reporting Hierarchy
You will need to identify to whom you must report your findings to, and how to report them. This
reporting hierarchy is important in obtaining the go/no−go decision to conduct the investigation.
Also, you might need to know who to ask for help in getting the cooperation needed to conduct your
investigation.
Escalation Procedures
If you have problems obtaining cooperation or in reporting findings of an urgent matter, you will
need to know the escalation procedures for your investigation.
25
Time Frame
For proper planning purposes, you will need to determine when you expect to complete your
investigation and any milestones management expects you to adhere to for your investigation.
These milestones might include status reports, for example.
Procedures
If you are the auditor or investigator, you may wish consider following these steps:
1. Review the filed complaint (i.e., the reason for conducting investigation).
2. Determine the legitimacy of the complaint.
3. Review policies and procedures, and appropriate legal statutes.
4. Plan how to conduct the investigation.
5. Determine the impact/feasibility of conducting investigation, or of not conducting one.
6. Obtain management's approval to proceed with the investigation.
7. Contact departments involved and those who will need to help.
8. Gather evidence.
9. Document evidence.
10. Present evidence to management.
Precedence
You will need to determine if there have been other investigations performed, similar to the one and
type you are about to investigate. Any past investigations can help with the planning and execution
of the current one. Also, prior precedence may have already been set that should be considered
and adhered to, such as disciplinary actions previously taken, disclosures made to external third
parties, etc.
Independence
Evaluate your ability to act independently. Do you have the authority as well as the authorization to
be independent in conducting your investigation? If not, why not?
Good documentation tied to sound processing procedures is essential for success in
computer crime cases. Without the ability to reconstruct accurately what has been
done, crucial evidence may be subject to question. More important, the qualifications
of the expert witness can become an issue if the computer evidence processing was
done haphazardly.
— Michael R. Andersen
New Technologies, Inc.
Computer Evidence Processing
26
Chapter 2: How to Begin a Non−Liturgical Forensic
Examination
Overview
Carol Stucki
When you have obtained the go−ahead from management to begin an investigation, you will find
the steps and procedures for many types of investigations in this chapter. The most common and
main type of investigation that this chapter discusses is the non−liturgical examination. The
non−liturgical investigation is one that is not foreseen to be taken to trial or involve litigation.
However, you should always conduct the investigation using the same procedures as if you are
going to trial. By conducting an investigation in thi manner, you will have all the evidence you need
in the format you need it in to take action in front of company mnagement or in a courtroom.
One of the first things to consider is: Do you need to isolate equipment or files? If yes, you need to
move quickly on this in order to preserve any possible evidence. What you preserve and find on the
equipment, most likely a PC, will be the basis of your forensic examination. This chapter reviews
such topics as the isolation of equipment, isolation of files, tracking of Web sites visited, tracking of
log−on duration and times, tracking of illicit software installation and use, and how to correlate the
evidence found.
Isolation of Equipment
Should you need to isolate or quarantine equipment as a part of your investigation, you need to take
a few steps to (1) ensure the protection of the equipment, (2) isolate and protect data from
tampering, and (3) secure the investigation scene. First, you need to ensure that you have the
authority to take the equipment. If you are taking any equipment, you should first get authorization
from management. If you take working equipment, they will need to make arrangements to replace
it while you conduct your investigation.
The first thing to do is ensure that the PC you are about to take as part of your investigation is the
correct unit, the one actually used in the illegal activity, used by the employee under investigation.
This can be done by checking the asset records, or the records that are kept in some corporations
by the operations department. If you need to take an employee's PC, you need to have a witness
and have the employee sign a form stating that you took the PC; record the serial number, make,
and model, when you took it, and the reason. If you do not have such forms, ensure that you do
record what action was taken, obtain the employee's signature, and secure the suspect equipment.
If you have to take an employee's PC, you must move quickly to ensure that the evidence is
preserved intact and not tainted, altered, or even destroyed.
Once you have the PC in your possession, you need to preserve the "chain of evidence." You
preserve the chain of evidence by making sure that neither you nor anyone else is left alone with
the equipment. You should always record your actions with the equipment. A good way to record all
the actions and whereabouts with equipment or any other piece of evidence under investigation is to
keep a log. This log should show (1) who has access to the equipment, (2) who retains control over
the log, and (3) where the log is stored. Additionally, you should record the when (dates and times),
where, and why of your every action, so that every minute you have the equipment or data in your
27
possession is accountable. Even if you put this PC in a locked cabinet or secured area, this needs
to be recorded in the log.
One of the first things you should do with the PC is "ghost it." This means that you should back up
everything on the PC. This way, you can ensure that you will not lose the data when you conduct
your investigation. This also preserves the original data that might be disturbed during the
investigation.
It is very important for the backup of any data under investigation that the programs used to perform
this backup be independent and have integrity. That is, the programs should not be under the
influence or control of any person or other program or system that is outside the investigation team.
The integrity of the data and equipment needs to be ensured by the use of programs that will not
alter the original data in any way, either intentionally or accidentally.
There are a number of programs used to perform such backups that are independent and have
integrity. One such program is SafeBack, and it is freeware that is available on the Web.
Isolation of Files
Not all the data needed for an investigation will reside on a user's PC. Therefore, you need to gain
access to the same files and directories that the user has access to. The first thing to do is to
disable the user's ID. First, ensure that the administrator verifies what action (or actions) will occur
to the user's profile and accounts if the user's ID were to be disabled. Only after verifying that no
data will be lost, altered, or destroyed by disabling the ID, should the administrator proceed to
disable the user's ID.
You need to have someone with security or administration authority disable the users' ID.
Operations personnel or a systems/data security office can do this. The easiest way to disable the
user's ID is to change the password; but this is not the most efficient, as the user could regain
access if he or she were to guess the new password. Ensure that the administrator disables the ID
but does not delete it. In some security setups, deleting a user ID will cause data and files to be
deleted as well. Because this is not what you want to happen, disable only the ID.
Once the ID is disabled, the next and most important step is to copy all the files to whcih the user
had access. This provides a backup for your investigation, as the data cannot be quarantined. The
confiscated data, however, cannot be used by the business for as long as you need to conduct your
investigation.
Operations or security personnel should have paper files with access requests, and they can run a
report that shows what the user had access to on the system. Make sure the list or report they give
you contains the group access and public access files for the user. You need to investigate all of the
places a user could have copied or hidden data. For the investigation, you might be able to ignore
those files with read−only access, but it is always best to be sure and get it all.
Now that you know what the user had access to, request that operations personnel copy the files
into a secure location that only you and your team have access to. Copy the file structure as well —
all directories and sub−directories. Make two copies of the data: one as a backup and one for you to
use in the investigation. This is similar to taking a picture of the crime scene before you start moving
things around.
Now that you have a copy of the data to use, the following sections in this chapter provide various
examples of potential investigative areas, and demonstrate how you can use the data collected as
28
part of your investigation.
Tracking of Web Sites Visited
If your investigation requires that you track what Web sites have been visited by an employee, you
need to begin by reviewing the following items
• Cookies
• Bookmarks
• History buffer
• Cache
• Temporary Internet files
Here we briefly define each of these items, where to find them, how to capture the findings, and how
to evaluate what you have found.
Cookies
Cookies are messages given to a Web browser by a Web server. The browser stores the message
in a text file called cookie.txt. The message is then sent back to the server each time the browser
requests a page from the server.
The main purposes of cookies are to identify users and possibly prepare customized Web pages for
them. When you enter a Web site that uses cookies, you may be asked to fill out a form providing
such information as your name and interests. This information is packaged into a cookie file and
sent to your Web browser, which stores it for later use. The next time you go to the same Web site,
your browser will send the cookie to the Web server. The server can use this information to present
you with custom Web pages. Thus, for example, instead of seeing just a generic welcome page,
you might see a welcome page with your name on it.
The name cookie evolved from UNIX objects called magic cookies. These are tokens that are
attached to a user's ID or program and change depending on the areas entered by the user's ID or
program. Cookies are also sometimes called persistent cookies because they typically stay in the
browser for long periods of time.
You will find cookies on the PC's hard drive, usually the C: drive, under the Windows directory.
Cookies is a sub−directory under the Windows directory. The best way to access the Cookies
sub−directory and subsequent files stored there is via MS Windows Explorer (see Exhibit 1).
Exhibit 1: Cookies Sub−Directory File Contents
29
When you open this directory using Windows Explorer, you will find a listing of the Cookies for those
Web sites that you have visited. If there are no files under this directory, they have been deleted. If
there are files under this directory, you can view the dates and times they were last accessed. You
will also see the ID that was used to access these sites on this PC.
Cookies can be deleted in several ways. One way is manually. The user can access the cookies
folder and delete all information from the folder. If the deletion was done manually, one place to look
for cookies is in the Recycle Bin. There is a Disk Cleanup program that comes with Windows 98 and
higher that deletes the information in the following folders: Cookies, Temporary Internet,
Downloadable Program Files, Recycle Bin, Old ScanDisk Files, and Temporary Files. See Exhibit 2
for a look at the Disk Cleanup program. The Disk Cleanup program does not leave any place to look
for deleted files. There are also Cookie Manager programs that will automatically delete old or
expired cookies from your cookie folders. These programs allow users to set their own expiration
and archive dates. For example, the user can set the Cookie Manager to delete or archive all
cookies more than five days old. Some of these manager programs put the deleted cookies into the
Recycle Bin and some put them in a temporary archive folder. To find these archive folders, you
would have to research the program and find the archive files.
Exhibit 2: Disk Cleanup Program from Windows 98
30
For your investigation, you need to determine where each cookie takes you. Cookies can be named
many things (see Exhibit 1); so by exploring and recording where each cookie takes you, you can
determine what the user had been doing on the Web sites where the cookies came from. Note the
date and time of each cookie; this is when they were created or accessed by the user for the first
time for this site. However, some cookies are generated without a user having to actually access a
particular site. These "magic cookies," which are generated without a user having to actually access
a particular site, are often marketing gimmicks or ploys to get the user to go to their Web site. To
determine where a user actually visited, you need to compare the cookies files to the history files.
History files are described later in this chapter.
Bookmarks
A bookmark is a marker or address that identifies a document or a specific place in a document.
Bookmarks are Internet shortcuts that users can save on the Web browser. Thus, users do not have
to remember or write down the URL or location of Web sites they might like to revisit in the future.
Nearly all Web browsers support a bookmarking feature that lets users save the address (URL) of a
Web page so that they can easily revisit the page at a later time.
There are two places bookmarks or favorites are stored. One is in the Web browser under Favorites
(see Exhibit 3). Another is on the C:, or hard, drive under the Windows folder, in the sub−folder
called Favorites (see Exhibit 4).
Exhibit 3: Favorites from Web Browser (Explorer)
31
Exhibit 4: Bookmarks from Hard Drive View
The bookmarks or favorites are stored under the users' desired names. However, by clicking on
these, you can visit each Web site the user has marked. Because bookmark names can be
changed by the user, by sure to examine each one carefully. Be sure that you do not casually skip
over a seemingly "tame" bookmark name simply because it does not look like it would be pointing to
an unauthorized Web site (e.g., PrettyFlowers@Home). There is no real way to hide a bookmark,
but users can bury a bookmark in a folder they create in the bookmark area. So be sure to open the
folders you see in the bookmarks listing.
There is an added advantage to seeing the favorites listing from the user's C: drive view. You can
see the dates and times when the bookmarks were created or modified. However, this does not
provide you with a listing of times when the sites were actually visited, or how frequently.
History Buffer
A buffer is a temporary storage area, usually in RAM. The purpose of most buffers is to act as a
holding area, enabling the CPU to manipulate data before transferring it to a device (e.g., a printer,
external device, etc.).
Because the processes of reading and writing data to a disk are relatively slow, many programs
keep track of data changes in a buffer and then copy the buffer to a disk. For example, word
32
processors employ a buffer to keep track of changes to files. Then when you save the file, the word
processor updates the disk file with the contents of the buffer. This is much more efficient than
accessing the file on the disk each time you make a change to the file.
Note that because your changes are initially stored in a buffer, not on the disk, all changes will be
lost if the computer fails during an editing session. For this reason, it is a good idea to save your file
periodically. Most word processors automatically save files at regular intervals.
On the other hand, a history buffer is a storage area on the Web browser of URL sites. What the
history buffer shows you, from the Web Browser's point of view, is what URLs or sites have been
visited by day and what screens have been opened under each URL (see Exhibit 5).
Exhibit 5: History Buffer from Web Browser
To get to the history buffer, go to the Web browser. On the tool bar there is an icon or button called
History (see Exhibit 5).
The history buffer can be cleared out by the user by simply highlighting and deleting the items in the
list. The deleted contents from this list are not stored anywhere else in the browser, but they still
exist in the hard drive history buffer.
The view of the history buffer from the hard drive point−of−view is a little different (see Exhibit 6).
This view is found via the path Windows, History. Here you see the days of the week that the user
actually accessed the Web. By opening one of the days of the week sub−folders, you can see the
actual listings of the URLs visited by the user, and the time and dates the sites were last visited. By
combining each day's lists, you can derive a pattern of visitation (and browser utilization) to each
Web site.
Exhibit 6: History Buffer from Hard Drive View
33
Such information may document/prove that an employee (or at least the individual who sat at the
particular PC under review) was accessing the Web: (1) in violation of company policy; (2) during
working hours instead of only during predetermined allowable times (i.e., lunch breaks); (3) on
weekends or during other off−schedule, non−normal times when employees or other personnel
should not be in the building/office; or (4) visiting unapproved or unauthorized sites.
Cache
Cache can be either a reserved section of main memory or an independent high−speed storage
device. Two types of caching are commonly used in personal computers: memory caching and disk
caching. A memory cache, sometimes called a cache store or RAM cache, is a portion of memory
made of high−speed static RAM (SRAM) instead of the slower and cheaper dynamic RAM (DRAM)
used for main memory. Memory caching is effective because most programs access the same data
or instructions over and over. By keeping as much of this information as possible in SRAM, the
computer avoids accessing the slower DRAM.
Some memory caches are built into the architecture of microprocessors. The Intel 80486
microprocessor, for example, contains an 8K memory cache, and the Pentium has a 16K cache.
Such internal caches are often called Level 1 (L1) caches. Most modern PCs also come with
external cache memory, called Level 2 (L2) caches. These caches sit between the CPU and the
DRAM. Like L1 caches, L2 caches are composed of SRAM but are much larger.
Disk caching works under the same principle as memory caching; but instead of using high−speed
SRAM, a disk cache uses conventional main memory. The most recently accessed data from the
disk (as well as adjacent sectors) is stored in a memory buffer. When a program needs to access
data from the disk, it first checks the disk cache to see if the data is there. Disk caching can
dramatically improve the performance of applications because accessing a byte of data in RAM can
be thousands of times faster than accessing the same byte on a hard disk.
When data is found in the cache, it is called a cache hit, and the effectiveness of a cache is judged
by its hit rate. Many cache systems use a technique known as smart caching, in which the system
can recognize certain types of frequently used data.
How is cache important to computer forensics? You can get the last set of instructions or data that
was saved in the cache. This might be evidence you need to collect in your investigation.
Unfortunately, capturing the cache information is tricky and can only be done with special programs.
34
Temporary Internet Files
Temporary Internet Files are those files that are "image captures" of each screen/site that you visit
when you access the Internet or an intranet (see Exhibit 7). Temporary Internet Files is a sub−folder
under the Windows folder on the C: drive or hard drive of the PC.
Exhibit 7: Temporary Internet Files
The advantage of looking at the Temporary Internet Files over any other files is that this shows you
the address of the site, and when it was last modified, last accessed, and last checked. This can be
very useful when gathering evidence of too much Internet access, or inappropriate Internet access.
These can also be useful in proving a pattern of logon and duration times.
Tracking of Logon Duration and Times
If you need to review logon duration and times for a given user, you should contact the
organization's network operations group (or similarly named/empowered department). This group
can provide reports on any given IP address, user ID, and the times that the IP address and ID was
logged into the network. Some of these reports can actually tell what addresses the user accessed
and when. The most basic report should be able to tell when the ID was logged into the system and
when it logged off. With some of the current system architecture, the reports track and log all user
activity down to the keystroke. However, this detailed logging does pull down the performance of the
servers, so the logging is not always done to this level of detail. You must ask your network
operations personnel what type of reporting and subsequent information is available.
Ask for the entire detail report and see what they record; do not just ask for the basics; you might
save time and effort if you ask for everything up front. What you ask for should include not only the
activity but also the server monitor reports that pertain to the user, traffic monitoring, and site
click−through reports. You want any report that exists that might show what a given user was doing
at any moment. You might be surprised just how much information is available and how eager the
operations staff personnel are to use their expertise.
Some of the evidence you can gather to help determine logon and duration times can be derived
from the Temporary Internet Files and Recent Documents list. These files can help establish and
35
support patterns of use. Although a smart user might clean up these files frequently using the disk
cleanup utilities that Windows provides, it is always good to check to see what information is
available. The cleanup utilities are in the Start Menu, Programs, Accessories, Disk Cleanup. This
utility erases the Internet files, temporary files, and most cookies. See prior sections of this chapter
on how to find and access Temporary Files.
Recent Documents List
The recent documents list can show you the latest documents that a user has accessed. There are
two ways to see this list of documents, but only one shows you when the items on the list were
accessed. First, you can see the documents from the Start menu, under the Documents
"tab"/selection. You can click on any one of the documents listed and the document is brought up
on the screen (see Exhibit 8). You can also access the same list, via the Recent sub−folder under
the Windows folder (see Exhibit 9). This view will give you the name of the document and when
each was last modified. Windows 95 does not have this directory; only Windows 98 and more
recent copies of Windows have a Recent directory.
Exhibit 8: Recent Document List from Start Menu
Exhibit 9: Recent Documents List Hard Drive View
36
Tracking of Illicit Software Installation and Use
If you are investigating a user who may be loading illegal, illicit, or non−work−related software on his
or her PC, there are a number of places to check within the PC in question to prove or disprove
these unauthorized (and maybe even illegal) actions. Some of these key places include the System
Registry, System Information, and by simply viewing the hard drive's contents.
Before you begin this part of an investigation, you must first get a listing of all approved software
that can reside on a given PC. This list most probably contains things such as Word, Excel,
Microsoft Office, and other work−related software. There should be a master list (i.e., database) of
what software resides on every PC that Operations maintains. However, with some site license
agreements most of the software might be on a checklist, which Operations personnel use to set up
new PCs. Not all these software programs might be on every PC.
The company policies and procedures should have an outline of the software that is not permitted to
be loaded on a company−owned PC. The most recognizable programs that are usually not work
related are games. When looking for these types of programs, look carefully at the names of the
files; users often change the names to avoid detection. To double−check the programs' legitimacy,
actually launch all .Exe files to ensure that you get accurate information about what is actually
behind the file's name and residing on the PC. Remember: this procedure should be carried out on
the mirror imaged, working copy data, and not on the original PC — both to avoid corrupting seized
data as well as disrupting networked services or other legitimate data that may reside on the PC in
question.
As you are checking the software list, you should also note all the serial numbers and registration
numbers of all software that resides on the PC. These numbers should be compared to the software
licenses held by the company to ensure that the loaded software is both legal and authorized. For
example, a user might have MS Access on his or her PC, but the company might not have
authorized or actually loaded this on that user's PC. The user might have obtained certain software
packages in some manner, however, not complying with company procedures and thus it has been
illegally installed on the PC. This is the most common type of illegally installed software on company
equipment today. This is most risky to a company because software license infringement can be
expensive to a company if it is discovered and not corrected.
Okay, how do you actually begin to search for this evidence? First, you need your lists of what can
be on any given PC and what is registered to be on the specific PC you are investigating. You are
also looking for a list of all information that pertains to the PC under review; specifically, information
37
such as verification of assignment of the PC to a specific employee and, if available, all software
licensed for the given PC. You should then check and compare the information on these lists
against the master list maintained by Operations.
Next, you need to list all the programs that currently reside on the PC. There are several ways to
accomplish this. One method is to use the System Registry files; we refer to this as the System
Review. Another method is to review all files via the PC directories (i.e., Explorer); we refer to this
as the Manual Review. Both methods are discussed briefly in the following paragraphs.
The System Review
The system review can be conducted using some automated methods. One of these methods is to
use the System Registry files. There are several System Registries. We discuss the two primary
Microsoft registry files. One is a list of all software loaded on the PC; the other is a more
comprehensive list of what is loaded, when it was loaded and how it is configured. Both can be used
to verify that illegal or non−work−related software or hardware was loaded onto a given PC.
The more simple list of what has been loaded can be viewed by accessing the path from the Control
Panel, to the Add/Remove Programs icon (see Exhibit 10).
Exhibit 10: Add/Remove Programs Software Listing
A more comprehensive list of software and hardware that have been loaded onto a PC can be
obtained via the Microsoft System Information panels. The following path can access these: Start,
Programs, Accessories, System Tools, System Information (see Exhibit 11). This screen shows the
basic system information of the PC being investigated. The most useful information about a PC can
be found under the Components directory. This is where you will find some history — when things
were loaded and last modified (see Exhibit 12).
38
Exhibit 11: System Information Base Screen
Exhibit 12: System Information/Components/System/Basic Information
There are three levels of information shown on this screen: Basic, Advanced, and History. All three
can provide needed information in an investigation, depending on what you are looking to prove.
The Components/System/Basic Information can help determine if illegal or non−work−related
software was loaded onto a PC (see Exhibit 12). To determine if there is illegal software or
non−work−related software on the PC using this list, first you need a list of all legal software that
should be on the machine, along with any serial or license numbers for the software. This list should
be available from the Operations department that distributes and fixes the PCs. Next, take this list
and verify what software is on the machine; be sure to check the serial numbers. The
Components/System/Basic Information list tells you what software is on the machine and when it
was loaded. But the serial numbers will be in the "about" information or start−up screen for the
software. If the software is not work related, it will not be on your list from the Operations
department. You must check company policies about loading non−work−related software on
company PCs.
Another view to see if software has been loaded onto the PC from the Web is available via Windows
Explorer, in the Windows Directory under the Download Program sub−folder (see Exhibit 13).
Exhibit 13: Downloaded Programs Viewed from Windows Explorer
39
The Components/System/History information can show when a component (piece of hardware or
firmware) was loaded and when it was last modified (see Exhibit 14). However, many components
are modified when the user reboots or turns on the computer. The "red herring" items to look for in
this history would be things that were not issued with the computer and the user added himself.
These might include graphics cards, emulators, or sound cards. The Component/History files are
not much different in the information that they provide (see Exhibit 14).
Exhibit 14: System Information/Components/System/History
Exhibit 15 shows what has been updated in the last seven days. The Complete History file shows
when items were loaded or when they were modified since last being loaded.
Exhibit 15: System Information/Component/History/Last Seven Days
40
The Manual Review
One of the reasons for conducting the Manual Review as well as the System Review is to ensure
you have covered all of the bases. What the Manual Review will tell you, that the System Review
will not, is what actual applications reside on the PC.
The first step in the manual review is to locate all executable programs/applications on the PC. To
do this on the PC, start Explorer — not the Web Browser Internet Explorer, but the Microsoft
Explorer. Once there, from the top menu select Tools, Find, Files and Folders. This gives you a
pop−up box where you can identify what you want to search for. In this case, we use a wild card
query to find all files ending with .Exe, or all executable files. Set the "Look in" field to the drive you
are investigating; this is usually the C: drive. Select option to look at all of the C: drive. See Exhibit
16 for an example of the results of this search.
Exhibit 16: Find Files Named: *.exe
This can be quite an extensive list. However, you should check each of these references to ensure
they do belong to authorized programs. Most unauthorized programs are put under the Programs
directory, but do not assume anything; check them all. You can check them by actually launching
them. You can do this by clicking on the file from the Find screen. However, to record your findings,
it might be best to print this screen and manually check off each item on the list as you verify it.
A quick review of the items in the list might narrow your investigation. If you see icons on the far left
41
that represent something suspicious, you might investigate these first. Suspicious items might
include game or playing card icons. See Exhibit 17 for an example of an excerpt of the full list.
Exhibit 17: Find Files Named: *exe Excerpt of List
Exhibit 17 shows an item on the list with a Playing Card icon — see the freeplus item? This is
actually a game, and for most companies and systems may be a violation and should not be
installed on the PC.
Another thing to watch out for on your listing of files are Hidden files (see discussion below). You
need to check the system standards and settings to determine if the file manager allows you to see
these or not before assuming your file list is complete.
Hidden Files
A hidden file is a file with a special hidden attribute turned on so that the file is not normally visible to
users. For example, hidden files are not listed when you execute the DOS DIR command. However,
most file management utilities allow you to view hidden files.
DOS hides some files, such as MSDOS.SYS and IO.SYS, so that you cannot accidentally corrupt
them. You can also turn on the hidden attribute for any normal file, thereby making it invisible to
casual snoopers. On a Macintosh, you can hide files with the ResEdit utility.
Why are hidden files important to your investigation? If you do not have the settings on the Folder
Options set to allow you to view hidden files, you might miss evidence. To review the settings on the
PC you are investigating to ensure that you see hidden files, you need to launch Explorer. From the
top menu within Explorer, select View, Folder Options, and the View Tab on the pop−up box (see
Exhibit 18).
Exhibit 18: Folder Options to See Hidden Files
42
If the radio buttons are marked so that the hidden files are not to be shown, you will not see all the
files. You should reset these so that you can see the hidden files and ensure that you have a
complete list.
How to Correlate the Evidence
Now that you have captured the file evidence and the data, you can graph an access pattern or list
the illegal software and when it was loaded. Next, you need to check the access and download
dates and times against the timesheets, surveillance, and other witness accounts to ensure that the
suspect under investigation actually had the opportunity to engage in unauthorized acts using the
PC in question.
In other words, you need to ensure that the employee under investigation actually had access to the
equipment on the dates and times listed in the evidence. For example, if the employee had a
desktop PC and did not come to work on the date that illegal software was downloaded on his PC,
then you might need to look for other supporting evidence (e.g., access logs indicating potential
access from an external/remote location). Be advised that the investigator must obtain solid
evidence that the employee under investigation actually had an opportunity and was actually using
the PC at the time that the unauthorized action took place. Failing to link the employee to the PC
and to corroborate and substantiate the evidence, in an irrefutable manner, will result in an inability
to hold the employee accountable for his or her actions and further to prosecute the employee via
the existing legal system.
When reviewing the evidence you have gathered, you need to follow and show the facts — and only
the facts. If you have to make leaps in your logic to get from point A to point B, then you do not have
enough evidence to substantiate a claim.
Also, you need to ensure that you can adequately explain how the employee under review was able
to commit the offense, illegal act, unauthorized action, etc., and also be able to present
evidence/proof of how it was done. This proof should be simple to follow so that there is no doubt
that the offense was committed. Someone's career, in addition to their legal freedoms, could be on
43
the line as a result of your findings, as well as the organization's liability (for a wrongful or
unsubstantiated accusation). Thus, you want to be sure.
Works Cited
1. Webopedia, http://www.webopedia.com/, Computer Terms and Definitions Web Site.
2. Tinnirello, P., Ed., Handbook of Systems Development 1999, Auerbach Publications,Boca Raton,
FL, 1999.
44
Chapter 3: The Liturgical Forensic Examination:
Tracing Activity on a Windows−Based Desktop
Robert S. Greenfield, MCP
Gathering Evidence For Prosecution Purposes
One major guideline you need to follow when gathering evidence, whether it be files from a desktop,
server, mainframe, or Internet−based external server is to preserve the integrity of the data. This
means following careful procedures so you do not contaminate the subject data, and establishing a
custodial chain for that evidence so that it is gathered in an approved, supervised, and legal manner
for full admissibility in a court of law. Elsewhere in this book, such rules of evidence are covered;
thus, we do not take the time here to further elaborate, other than to say that you must be
conscientious about the manner in which such data is collected. Keep in mind also that initially you
may not intend to prosecute, and are investigating purely for a corporate policy enforcement, and in
the process of such investigation may come upon information that you will want to take legal action
on. For this reason, it is critical that you treat all data carefully. Realizing too that if you are not in a
"right to work" state, you may come under litigation from the targeted individual for an attempted
wrongful discharge suit. If this happens, you want to have all your chain of custody and evidence
handling procedures outlined and available for review so the courts will not find technical faults with
your methods of gathering evidence.
Gathering evidence for prosecution purposes is really the mode you should consider operating in
when a forensic examination is needed. For this reason, you should become familiar with the
Federal Rules of Evidence, as well as your local and state laws pertaining to the admissibility of
evidence and what is required to provide "expert witness" testimony should that become necessary.
You may not personally qualify as an expert witness in an area, so evidence gathered by you may
be disallowed in one or more aspects of your testimony for which expert witness status is required.
The Federal Rules of Evidence are an umbrella under which the subsequent states add their own
specific addenda. It is important that you check with your legal department regarding criminal and
civil applicability with regard to evidential rules. Get to know the standards that are expected, and
obtain if possible, the training to qualify as an expert witness in your state. You should also become
knowledgeable as to who you can utilize that would be considered a valid expert witness should you
need them. Be prepared with names of companies, individuals, and organizations as part of your
overall action plan as you establish it. Make sure you are prepared to deal with possible civil or
criminal prosecution needs well ahead of time. Make regular reviews of changes in laws that may
require you to make changes in your action plan as well. Developing a corporate response plan to
deal with these situations should be a top priority.
Gathering Evidence Without Intent to Prosecute
Of course, you should not let your intention not to prosecute sway your techniques in the gathering
of evidence, as discussed in the previous section. However, you may have a situation wherein you
are certain you will not have a case for litigation. While it is always preferable to have a complete
evidential custody trail, and strict gathering requirements followed, your company may not have the
funds, resources, or need to carry through at that level. Proper evidence gathering takes time and
can involve a high degree of computer expertise in the more complex cases; so if you take this path,
be aware that if you do find some illegal activity going on during the course of your investigation,
45
you will want to immediately stop your activities, and should keep a log of everything you have done
to the computer. It goes without saying that you should call the proper law enforcement authorities
immediately, naturally. Having the log of activities performed on the computer will also aid in their
subsequent investigation. Remember, even if you do not initially intend to prosecute, you may find it
necessary in the course of your investigation.
The Microsoft Windows−Based Computer
In a corporate environment, it is best to monitor a computer remotely and trap data that you wish to
examine for potential enforcement. This can be facilitated in a number of ways as discussed later. It
is also important to remember that there are many areas one can examine on the computer directly.
The Windows operating system and the programs that reside on it tend to leave lots of trails in
different places that work to our advantage as we audit the computer files.
Depending on which Microsoft operating system is running on the desktop, certain things may be
different. These are pointed out as needed where they occur. Some initial background on how
things work on a Windows−based computer may be helpful as a primer to look at the items that will
be discussed.
Operating Systems Versus Operating Environments
The Windows operating system under Windows 3.1, Windows 95, Windows 98, Windows 98/SE,
and even Windows ME are all more technically operating environments. That is to say, they do not
necessarily directly talk to your computer's hardware, but instead pass requests for things through
the actual operating system, which in the case of the aforementioned platforms is MS−DOS
(Microsoft Disk Operating System). Why is this important to know? Glad you asked. It is important
because tools designed to work at the DOS level can be employed on these platforms that would
not otherwise be available on systems running a true operating system that does not support all of
DOS in exactly the same way. Examples of a true operating system would be Windows NT,
Windows 2000, Linux, UNIX, and, of course, MS−DOS. All of these have direct communication
layers within them that deal with handling memory, storage devices, and external peripherals such
as the mouse, a scanner, the monitor, etc. These devices still use little programs called "drivers"
that tailor the communications between the device and the operating system for that particular
model, but that driver talks to the operating system in a standard way. Think of a driver as an
interpreter that tells the operating system what the device can and cannot do, and how to make it do
those things.
Storage Versus Memory
Another item that can cause confusion is the difference in storage and memory. You will often hear
people not familiar with computers confuse the terms. It is important for you to understand how
things are stored on a computer so that you can utilize the tools needed to examine them.
Memory
First and foremost, the term "memory" really refers to the amount of memory physically on computer
chips inside the computer itself. If you bought your computer at a store and it came with 128 MB
RAM, this means that the computer has 128 megabytes worth of chip memory. A byte is a single
character of storage. So, the chip memory in this case could hold approximately 128 million
characters of data. Not all of this memory is really available to the user because programs that
make the computer run load up in memory when it is powered on. The moment power is cut, or the
46
PC is turned off, regular chip memory is blanked out. This means that it is considered to be "volatile"
memory because it does not store anything after you turn the computer off.
Storage
There are two basic kinds of storage: online and offline. Put simply, online storage is that which your
computer can get to directly for permanently saving information. A hard disk is a form of online
storage because it is always available and not something that can be taken away under normal
conditions. As you are probably already suspecting, offline storage is that CD−ROM, DVD, or
diskette you use that can be popped in when needed and then taken out of the computer when
finished.
Hard disk and floppy storage are subject to exploitation by advanced hackers who may have
developed tools to utilize otherwise inaccessible areas of the hard disk for data storage. Techniques
can be employed that take advantage of something called "slack space" in hard drive sectors.
Basically, slack space is the unused space in a sector on the hard drive. Think of it as if the entire
hard drive storage were divided up like the mail slots in a hotel lobby for each of the hotel rooms.
When mail comes in (or in this case, a computer file to be stored is saved), it goes into the available
mail slot reserved for it. If you have too much mail to fit in the single slot, it may have to overflow
into the adjacent slot. The rule for this mailbox, however, is that once a slot contains a file, or part of
a file, another file is not normally allowed to be stored in the remaining open portion of that mailbox
(or sector in our case) even if there is plenty of room, and the next available mail slot is used. What
happens to the potentially empty portion of space in the sector? Well, normally it goes to waste.
That is why you can fill a hard drive up with lots of small files that do not add up to the rated storage
capacity of the drive. The secret here is that low−level programs can be written to take advantage of
these "slack" areas for data storage. Another thing to keep in mind is that data in a slack area may
have belonged to an incriminating file prior to its deletion, and a smaller file was subsequently
stored on top of it; thus, some of that incriminating information may be left behind in that "slack
space." A smart perpetrator can also take advantage of tools that supposedly wipe out information
with multiple passes of file writes that write a series of binary 1s and 0s in a series of seven passes
over the file area. While recovery of information wiped out in this manner is far more difficult, and in
many cases impossible with any meaningful results, some recovery techniques exist that specialists
can employ to retrieve some of the data. Factors such as the size of the hard drive, the accuracy of
the mechanical system in the drive, the power with which the information was recorded, and even
the length of time the information was left on the drive prior to wiping all will have an effect on the
probabilities for recovery. Performing such recovery is available from companies that specialize in
these tasks, but be advised that it is not inexpensive to have this done.
Detecting these sorts of situations requires a high level of expertise, and normally you will want to
bring in a law enforcement agency, or forensic analysis consulting team, to get at that level of data
obfuscation.
How Windows Uses Memory and Disk Storage
Windows uses memory in the computer and hard disk storage to run. It loads programs into
memory that tell it everything from what kinds of devices are attached to the computer, to how to
display a screen and sense and display mouse movement. Windows operating systems and
environments are a set of interconnected programs at their low levels, and normally not all of it will
want to fit into memory at a given time. This is especially true for things that are "in work," such as a
document, browsing the Web where a Web site page needs to be temporarily stored, etc. Windows
will use part of the hard drive in a computer to enhance its ability to store data of an intermittent or
intermediate nature. Windows refers to this use of part of the hard disk as virtual memory because it
is there to serve as a holding place for things either not yet saved permanently, or things that it uses
47
only during the running of a program but that are not part of the final product.
General Guidelines To Follow
The following tips are important when making a review of a suspect computer and should be
followed in any pursuit of suspicious activity, regardless of whether or not you intend to prosecute in
a court of law.
Have a corporate action plan. This plan should be in place prior to ever needing to put it to the test.
You should make sure you know in advance the various law enforcement agencies, groups, and
consultants that can bring expertise to bear if needed. Make sure you have sufficient planning to
cover incidents from both the nonskilled perpetrator and the advanced internal hacker. Remember
that most corporate security precautions keep out most of the bad guys, that your real external
threats will be from advanced hackers, and internal threats abound because those individuals are
already behind your external security screens.
Things you should think about as far as advance planning include what tools can be put in place to
monitor employee activity if called upon to do so. Some are mentioned in the course of this chapter,
but their mention is not to endorse any one company or product over another. There are many
companies with many fine products out there. We hope to provide some starting points only.
Indeed, the landscape changes far too rapidly to be able to provide an absolute recommendation of
any one product in this book because, by the time this is written and goes to press, additional tools
from other companies may well be available. It is for this reason that alliances should be formed by
you with other corporate auditors to find out what they have done, and are doing. This personal
networking of knowledge can lead to your most valuable arsenal of tools, advice, and awareness of
services being provided by other firms.
Document everything you do. As an auditor looking for information, you may be called upon to
testify as to your processes and procedures. Make sure that you keep a log with date, time, activity
performed, and outcome of that activity. This log will come in handy as you proceed through your
analysis. You should develop a standardized procedure that works for you in these cases, in
accordance with your training and expertise in a given area, and then follow that as the template for
your log of activities. This assures a consistent and thorough approach.
Leave ego at the door and do not overstep your training level. If you feel that the investigation will
require someone with forensic analysis experience in computers, seek out a forensic analysis firm
or your local law enforcement agency to assist. People with a high degree of understanding and
technical know−how today can perform criminal activity on computers. Even your local company
computer expert is not necessarily equipped to deal with this. Information is presented in this
section relating to how data can be hidden, but such information should be looked upon as
information that provides a better base of understanding; it is not a substitute for training in these
areas of analysis.
Always assume that you are going to run into something of an illegal nature, and follow the rules
laid out in the Federal Rules of Evidence. These rules exist to make adjudication rulings against a
victimized person or company less likely. Be aware that when you, or a company brought in to do
the forensic analysis, fail to follow these Federal Rules of Evidence, you run the risk of having the
case tossed out of court. Solid cases have been compromised on technicalities due to lack of
adherence to these rules.
48
Always, ALWAYS assume that a computer has been set up by a potential perpetrator to destroy
evidence if the computer is used in a "normal" manner. Programs called Trojans (as in Trojan horse
lore) can be put in place that would activate upon start−up of the computer in a regular mode that
could wipe out, or otherwise damage potential evidence. A Trojan horse is a program that
masquerades as a legitimate program but is really sitting in wait to be activated by the unwary.
Always work only from backups of the data sources on a computer. This means bitstream backups
of the hard drive, floppy diskettes, etc. Never work directly on the computer itself (other than to
make the initial backups) because any potential damage that is done either by you, or by the booby
trap of a perpetrator, could ruin your one and only chance of getting the goods on him or her.
Once you have made a backup of the data, make a backup of your backup and work only from that
working copy of your backup. That way, you can re−retrieve information from your primary,
protected backup should it become necessary.
When you make a backup, use a product that does a bitstream backup. Standard file copy or file
backup programs will not perform these kinds of backups. It is critical that a bitstream backup be
used so that data hidden in places on the hard drive can be preserved. A clever perpetrator may
actually try to hide files in areas on the hard drive marked as bad when they are not. Files can also
be encrypted, and you may only have ghosts of the original file in areas of the computer's file
system that are marked as deleted, when in fact they still physically exist. A bitstream backup will
make an exact 100 percent mirror−image copy. Tools to do this were originally made for network
administrators for the purposes of creating online backups and for distribution of mass installations
of software throughout a corporate enterprise. These tools have been vastly improved over the
years, and one of the standard tools in use by the FBI and other law enforcement agencies is called
SafeBack; it is available from New Technologies, Inc. (http://www.forensics−intl.com/) to authorized
personnel. Other tools for making image backups exist from well−known companies such as
PowerQuest Corporation (http://www.powerquest.com/), which makes DriveImage Pro. This utility
can make exact partition backups as well. Regardless of the product selected, and there are many
other products from various vendors out there, you should learn how to use them long before you
ever have to use them. The time to learn is not when you have a crisis and need to employ the tool.
Always practice making backups with the tool and know its features. Questions about a product
should not go unanswered. The only stupid question is an unasked one. Do not be afraid of asking
anything of the appropriate support people. Some companies offer training in the use of their
products, and even provide consulting services. While this book is a guide for the auditor wanting to
investigate issues of compliance forensically, it is not a substitute for training and the use of
experienced individuals, especially if criminal activity is involved. You may wish to bring in a
forensics expert and work side−by−side with him or her through your first few incidents. In the
corporate environment, you should not work in isolation if at all possible. This gives you the support
you will need at first, and it will add to the verifiability of activities performed.
If activity of an illegal nature is suspect, or if activity is suspected that is not in compliance with
corporate computer use policy (if such a policy exists), and you want to maintain surveillance on the
employee's computer use to further build a case, you must use caution when obtaining information
so that the employee does not suspect any evidence gathering activity. Fortunately, especially in a
network environment, tools exist today that allow such covert monitoring to be easily facilitated.
Some of these tools are discussed later. In the case where a network is not present, or where
technical expertise or finances to bring in such expertise is limited, you may need to examine files
from the machine by first−hand inspection. This means that you will have to visit the machine and
gather the evidence directly. When you do this, you will have to be very careful that you do not alter
the files on the machine itself.
49
One of the tools this author recommends, if you do not have a network, is an external CD−RW or
Iomega Zip or Jaz drive that connects to the computer via a USB connection. Most computers now
have USB ports. If the suspect computer is running Windows 95 Revision B or later, support for this
technology is already embedded in the operating system. These devices allow you to plug into the
PC using the USB port, and then unplug, without having to reboot the computer. This is even truer
of Windows 2000 machines, for which the USB support is exceptional. An external CD−RW drive is
preferable because you are recording to a medium that does not provide for on−media alteration of
a given file provided you are using CD−R media. CD−R media are blank CDs that allow you to write
once and read many. The fact that you cannot erase them afterward, or rewrite files already placed
on the CD, makes them excellent for preserving evidence that you may need to present in litigation.
You should make your bitstream backups to the CD−RW drive.
The driver support for Iomega Zip drives is already native in Windows 95 Revision B or later, so you
will not need to install additional drivers. Support of the external CD−RW drive may require
installation of drivers. If this is needed, the author recommends that you make it a companywide
project to install the drivers for it on each and every PC. The reason for this is twofold: (1) it will be
readily available to anyone who needs to make a backup of something important; and (2) it will
make it easier to perform covert archiving in the future. Making it part of the corporate standard on
the desktop for computers not connected to the network also masks the fact that you may be
interested in just a particular individual and in obtaining records from just one specific machine at
the moment.
Adopting a corporate standard such as the CD−RW device drivers, and therefore requiring your
company computers to be updated, also provides a window of opportunity for the installation of
other software to aid in monitoring activity. Some of these monitoring products perform their
surveillance over the corporate network; others do it on the machine itself; and others support a
combination of these environments. One such monitoring product even allows for the covert
e−mailing of screen captures and activity logs.
Let us examine some of the areas that are valuable to know about on a Windows−based computer.
There are many different areas that the computer uses on a PC to store data, either permanently or
temporarily, which can be of use as you conduct a review of activities that have taken place on a
given computer. We examine the following kinds of files and file areas on the computer that can
provide insight: cookies, bookmarks (a.k.a. Favorites), history buffers, cache storage, temporary
Internet files, the system registry, recent documents list, and hidden files. We look at each of these
in turn, tell you about their purpose, and how you can exploit their existence for your benefit as an
investigator. In the absence of a covert observation tool, it can be very handy to know about all of
these areas. We also discuss how some of the covert observation tools work and how you can
employ them.
Cookies
This is a term you have no doubt heard bandied about for quite some time. There has been a lot of
information, both good and bad, as to what these files are and what they can do. Hopefully, this
section will clear up that vague and often−misunderstood file type.
First, what exactly is a cookie? Simply put, a cookie is a file that usually holds things such as a user
name and password for a given Web site, any custom settings that may have been put in place for a
given Web site, and other data that the Web site may track with regard to the user's visit there. It
could contain anything that the Web site has been programmed to store there. It may have, for
example, the date and time of the user's last visit, how many visits the user made, and if the user
50
likes to view the Web site with background music on or off. One of the things that cookies normally
do not have in them is a complete history of where the user has surfed to on the Web before going
to that site. It is possible, however, for it to have information about what site the user was at just
prior to visiting the one the cookie is attached to. Other information that can be recorded is the IP
address of the computer, and where, once the user was on the site, what pages were visited.
Normally, cookies are used to enhance the visitor experience by allowing the site being visited to
better customize the viewing experience and tailor it to the visitor. Privacy concerns with regard to
the use of cookies are valid to the extent of how much the user wants to reveal to a Web site, and
what that Web site has in the way of a privacy policy stating the terms of use. There are utilities out
there that will allow the user to control the use of cookies on a computer, and the user can also
determine, in the Web browser settings, whether or not to even allow the use of cookies.
From an auditing perspective, the presence of cookies can be great. Adult Web sites often use
cookies for the capture of information and customization of site settings. As a result, one usually
finds a cookie file for most popular adult Web sites. It should be noted that care should be used
when implying that an employee is intentionally visiting adult Web sites on a corporate computer.
For example, an employee may have wanted to go to the White House Web site and typed in
http://www.whitehouse.com/ instead of http://www.whitehouse.gov/. The address ending in .com is
an adult Web site; the address ending in .gov is the official Web site of the White House in
Washington, D.C. Corporate policies usually address the accidental visiting of a site such as the
one mentioned above. By examining cookies, one can determine how often such "mistakes" are
made, and thus reveal if there is a pattern. Someone who visits such a site and immediately backs
out of that site is probably not intentionally going to it; but someone with an established pattern of
visits for any length of time may very well be abusing the resources of the company.
Cookies are stored within a Web browser's file area, and on systems that provide user−by−user
security and preference settings (Windows NT, 2000, and XP), they will be within the individual
profile for that user within that user's cookies folder. For example, Exhibit 1 is what it would look like
on a Windows NT or Windows 2000 machine if one were to display this using Windows Explorer.
Exhibit 1: Windows Explorer Cookies Folder
Notice that the file extensions on the cookie files are .txt. That means that they are text files and
that they can be opened using the Notepad application to examine the contents. While this sounds
great, often doing so reveals little because the data is usually not directly readable in a meaningful
manner. The reason is the way computers store numbers, and also the way those the numbers are
subsequently displayed. Many times, the characters coming up mean very little except for the
occasional cleartext message sometimes embedded. If there is an AOL cookie on a computer, for
example, it may say inside it that the user needs to keep the cookie because the user has saved
settings specific to his or her user identity. If the user opens one of these cookies using notepad,
Exhibit 2 is what he or she might see.
Exhibit 2: Adverstisement Site Cookie
51
As seen in Exhibit 2, not much is readable other than the URL from the Web site that placed it there.
Utility programs are available that will allow the user to open and view the contents of a cookie in a
somewhat more organized fashion, but for our purposes with auditing, the presence of the cookie
and the Web site it is connected with is the most valuable portion. It proves that a visit to the site
took place. Even if one of the available utilities is used, chances are that the individual other
numbers stored in the cookie will have little meaning to anyone other than the Web site that created
it. There is no fixed format requirement for a cookie, so it is difficult to obtain consistently useful
information from cookies other than the originating URL and the creation date−time stamp, which
indicates when the site had been visited initially. If the cookie gets updated or accessed, it may
either get a new date−time stamp or it may have a new "modification" date. Using Windows
Explorer, right−click on a cookie file and click on the Properties option that shows up. Under the
"General" tab, the user will see something similar to Exhibit 3.
Exhibit 3: Windows Explorer File Properties
52
Notice toward the bottom of the window in Exhibit 3 the date created, the date it was last modified,
and finally, the date it was last accessed on the computer. Be careful when checking this so as not
to double−click on the file in question, but simply right−mouse−click only and bring up this
property page. If you do accidentally double−click on the file, it will alter the Accessed: date. Be
advised that the Accessed: date can also be modified if you perform a backup or copy of files from
the system. See the suggestions for isolating the computer equipment from changes prior to
performing any file operations.
Copy the files to your CD−RW drive to archive them. Another added advantage to the cookies is
that they are named with the user ID of the person logged on at the time they were created. This is
true of Windows NT, Windows 2000, and later computers as they provide the security by individual
logon ID. On older Windows 95 or Windows 98 machines, the cookie files may not have any such
identification, so you will have to correlate their creation and update dates with the individual's
opportunity to imply a connection.
Bookmarks/Favorites
Depending on the configuration of the computer, it may have Microsoft's Internet Explorer (MSIE)
Web browser or the Netscape browser. These are the two most common on corporate computers
running Windows, although there are other browsers out there, such as Opera, or even some
shareware or freeware Web−browsing tool. We will speak to the MSIE or Netscape tools in this
book because they are prevalent.
A bookmark (the Netscape term) is the same thing as a Favorite (the Microsoft term). It is a record
of the URL (uniform resource locator) that is the address on the Web of a given Web site. These
URLs are held in special locations in each of these browsers and, in the case of Microsoft's
Favorites, also become available in many other applications as well.
53
Netscape will have the bookmarks stored as part of a file (by default, it is called "bookmark.htm").
This file is actually stored in the same way as a Web page is written. You can look at the file to find
out what places the individual likes to visit. When you are looking for these bookmark files, keep in
mind that the user can customize several bookmark files under different names, and open them
manually to get at the bookmarks. Also keep in mind that the user may be trying to hide the file by
setting its file attribute to "Hidden," or calling it something other than "Bookmark." On Windows NT
and 2000 machines, this file may reside in the individual's account area on the computer, but you
should look for bookmark files in all areas on the computer.
The Microsoft Favorites present a different issue. They are stored differently and can be customized
at different levels. First, on Windows 95− and 98−based systems, there will be a folder on the
computer called Favorites. Within this folder, you may find sub−folders that could be named for
whatever the user wanted (category, topic, company name, etc.). And then within these sub−folders
there may be additional sub−folders or actual files called Shortcuts, which are files that hold the
URL information. On systems supporting multiple users (primarily, these will be Windows NT and
Windows 2000 systems), you may have a Favorites folder under an All Users account, which are
Favorites that will be available regardless of who is logged on. Under normal conditions, if the user
does not have administrative rights (assuming this is a Windows NT or Windows 2000 machine), he
or she will not be able to change the All Users folder contents, including the Favorites sub−folder. If
this is a Windows 95 or Windows 98 machine, and a user wants to alter an All Users, Favorites
folder contents, there is nothing to prevent its alteration. Make sure to examine each Favorites
folder for its contents, and check the sub−folders all the way down the line. Keep in mind that
individual files and folders could have the Hidden file attribute turned on. You will want to make sure
that you use the Windows Explorer with its settings enabled to show hidden and system files. Also
remember that you will need to be logged on to that machine as the administrator (in the case of
Windows NT and Windows 2000 systems) to be able to traverse across all the folders wherever
they may be.
Internet Explorer's History Buffer
One advantage of the Microsoft Internet Explorer is that it keeps a history of where someone has
surfed. By default, this option is enabled on Internet Explorer. The individual user can change the
time span with which it will track this Web site visitation history, so you may not reap as much
benefit from it, depending on how far back it is set to track. It will, however, track all sites visited. So,
if a URL was typed into the browser's address bar, clicked from a Favorite entry, or clicked from a
hyperlink on a Web page, it will be recorded in the history if it is enabled. Be aware that it is possible
to set the history level to record 0 days of history, and to automatically clear all the browser cache
upon exit. It is also possible for the user to manually clear the history by clicking on the option in the
Internet Options dialog box within either Internet Explorer, or under Internet Options in the Start,
Settings, Control Panel, Internet Options area, which brings up the same dialog.
If the contents of the history buffer are available, you hopefully will have a record of repeated use of
the Internet in whatever form your company may consider to be abusive (surfing pornography,
slacking off by excessive surfing, surfing non−business−related Web sites, etc.). You should look at
the history buffer, either from a fresh restore or before you check out the other items in the Favorites
list, because any new visits will generate additional entries into the history buffer.
54
Temporary Storage on the Hard Drive
Let's say you were typing a document in Microsoft Word. Very long documents with lots of pictures
may not all fit into the available chip memory, so Windows uses the hard drive to fool the program
into thinking you have more memory than you really do. Now, let's say you are working on a critical
document. You cannot afford to lose the work being putting into it, so you have turned on the Auto
Save feature of Microsoft Word. At a given interval, it will "flush" what it has in memory and virtual
memory to a file on the hard drive in a temporary location. Microsoft Excel and Microsoft Word have
these automatic save options. It is something to keep in mind in examing a system for files because
some of these image files may be left over and could be examined.
When a document is being written, or a spreadsheet is being worked on, often times a file is created
by the application making the document in what is called a "temp" area. This "temp" area is just
that: a temporary area where files are located while they are being worked on and prior to being
formally saved in some folder of the user's choice. On Windows−based computers, the area that is
used by default is determined by settings stored in the computer. These settings are held in memory
as a reference to where these temporary files should go. The memory reference is labeled with a
variable name and is part of the environment within which the computer operates. The two
environment variables involved here are the TMP and TEMP variables. They are set to point at
some given location on the computer. By default, on Windows 3.1, 95, 98, 98/SE, and ME systems,
both will point to the location of C:\Windows\Temp or C:\Temp, depending on which operating
system you are working with. On Windows NT/2000 platform machines, the values set for the TMP
and TEMP environment variables will be set to a path sensitive to what user is logged on, so you
would have to either try logging on as the individual, or, preferably, as that computer's administrator
user and then locate the TEMP folders for the suspect user ID. To be sure where these variables
are pointing, click the Start button, usually located in the lower left corner of the screen, and then
click on Programs. Find the item in the menu labeled MS−DOS Prompt. Click on it and it will bring
up a window that looks like the following:
In the window at the C:/> Prompt, type the word Set and hit Return. The system will show you
information about what is stored in the computer's Environment Variables. Make note of where the
TMP and TEMP variables point as this directory (also known as a folder), holds residual files at
times that may aid in the process of detecting use of the computer for illicit purposes.
On Windows NT/2000 systems, you can click on the Start button, then Run, and enter the word
CMD into the Run window. It will bring up a box as shown in Exhibit 4. In the box, simply enter the
commands SET TMP and hit the Enter button and SET TEMP and hit the button again. This will
show the setting of these two Environment Variables. Exhibit 5 shows the values when logged on as
the Administrative user on Windows 2000.
Exhibit 4: W2K Command Window
55
Exhibit 5: W2K Command Window
Temporary Internet Files
Just as with a Word or Excel document, a Web browser also uses a temporary location to hold all
those graphics and other information on a Web site when you visit a particular location on the Web.
In the case of Web browsers, they store data in temporary areas referred to as cache. This cache
storage is functionally the same as the TEMP space described previously, but kept separate for the
purposes of the Web browser's exclusive use. The idea here is that that if you have visited a
particular Web page, downloaded that page, and gone to a subsequent page, it is faster, should you
hit the Back button on the browser, to reload the page from hard drive than to download everything
again. From an auditing perspective, this can be very useful because, if this area is not cleaned off,
you can have the complete trail of what that person saw and downloaded on the Web and save
copies of it for evidence. While the savvy Internet user may know to clean these off, or have the
Web browser set to remove the files automatically, it is still an opportunity area that should not be
overlooked. Most of the files that will be in this area will be HTML documents, graphics files, or
perhaps some other Web−based scripting languages or programs. After archiving these files for
safekeeping, you can make subsequent copies of them and view them using your own Web
browser on your machine to open the HTML files directly and display the pages that were
downloaded. Again, it is important to preserve the copies you made of the suspect machine intact
and only work from subsequent copies so you do not alter or contaminate the evidence. It is also
valuable to note the date−time stamp on these files and correlate them with the individual's use of
the computer to further enhance the evidence chain.
Another consideration you may have to deal with is a multi−lingual suspect. Internet Explorer is
particularly advanced in its ability to handle multiple language sets. Netscape provides this as well,
although at the current time not to the same level as Internet Explorer. If the saved Web page
appears to be unreadable and you bring up the HTML page using a program like Notepad, for
example, it may be that the non−HTML portions of the page are in an alphabet other than English.
You should therefore use the browser to examine the HTML files. Because you are working off of a
bitstream backup, whatever languages were supported will be similarly supported in the computer
you are using to examine the files. You may have to get a translator involved if you do not speak the
language. Do not assume that the page being examined is of no consequence just because it is in
Russian, Chinese, or Greek. Cybercrime now spans the globe, and the Internet facilitates it
instantaneously. The larger a company grows, the greater the likelihood of having to deal with a
multi−lingual situation. If your company hires people from abroad, you may well have to deal with
languages from any of those countries because the suspect may well be conversing with people in
his or her homeland via e−mail, or surfing to a Web site there, etc. The key here is to be prepared
56
and assume nothing. This author once worked in a firm that brought in people from India, became
good friends with a number of them, and learned that in just that group of people there were 15
different dialects of the same native language represented. And, to further complicate matters,
some of these dialects were so divergent from one another that the only language that they could all
consistently communicate in and be properly understood was English. Subtleties like this are things
you may have to cope with. If you are dealing with someone as a suspect from abroad, it may not
necessarily be enough to have someone familiar with just the general countries language, but be
versed in the specific region's dialect as well.
System Registry
The system registry is a key set of files that allows the computer to track and make available certain
key aspects of computer applications system level files. A registry entry may contain, for example,
the path and filename of a particular file, and its version number. A program with such an entry can
use that registry entry to check to see if maybe a system level file was changed over what it
expected to see on the computer. Things such as the individual support components of a program,
the program itself, and data pertaining to registration, licensing, use, and features of that application
also may reside in the system registry. For example, your individual copy of Microsoft Word,
Microsoft Excel, or some other piece of software, may put its registration information directly into the
system registry and correlate this with a licensing monitoring program in your corporate structure.
What you as an auditor would be looking for in the system registry would be programs that may
have been illegally installed on the computer, legitimate copies of software that may have been
illegally installed on more than one computer, or other bootleg software that may open the company
to litigation if licensing is not obtained from the vendor.
A computer−savvy perpetrator can use the system registry to hide or alter registration, or other
information as well.
There are tools you can use to scan the system registry, many of which are shareware tools, but
there is already a handy tool provided by Microsoft. It is called Regedit.exe (which is short for
Registry Editor). You do not normally see it but it is there. If you left−mouse−click on your Windows
Start button, you will see the pop−up menu appear (Exhibit 6). At the bottom of this menu is an icon
that says Run beside it. When you click it, it will bring up a prompt for a command to run (Exhibit 7).
Type in the word "regedit" and hit return or click the OK command button. This will bring up the
Regedit program. It is very important that you work carefully so that you do not accidentally change
a registry setting. This program is designed for you to be able to actually look at registry entry
settings, and, if you are knowledgeable, change settings. For our purposes, we utilize this merely as
a tool to view what things are stored in the registry. The screen for the Regedit program looks like
the one in Exhibit 8.
Exhibit 6: W2K Run Command from Start
57
Exhibit 7: W2K Run Command Regedit
Exhibit 8: Regedit Screen Shot, with Registry Menu
The left half of the window that appears shows the section of the registry you are viewing, and the
portion on the right is the specific entry or entries that pertain to that section. The Regedit window
works in a manner similar to the Windows Explorer, with a folder−based architecture. This
architecture serves to compartmentalize entries in the registry based on function and applicability
within that function. Registries can be huge, and you should be prepared to spend time sifting
through this. You do not want to skip through something because that something you skip may well
be an area that someone has hid something.
58
The best way to systematically go through the system registry is to print it out and scour the
hardcopy. This way, you can check off each entry as you examine it. It is tedious, but this ensures
that you have covered all your bases and it can further be utilized as an exhibit in court, provided
the proper rules of evidence and chain of custody are observed. To print the registry, click the
Registry menu item in the upper left corner to bring up the drop−down menu (see Exhibit 9). On the
menu you will see the entry for Print…. This will let you print the entire registry, or just the selected
branch of that registry if you are highlighting just an individual portion of it.
Exhibit 9: Regedit Printing Function
Remember, registries are sometimes huge. So, when you are printing this, have patience and lots
of paper on hand. I would recommend that you have a high−speed laser printer for this, due to the
resulting print job size, but any Windows−based printer will do. As you scan through the printout,
keep in mind that you are looking for something that is abnormal, hidden, or possibly look legitimate
but pertain to a bootlegged piece of software. Remember also that a savvy computer user may have
altered an entry to appear completely legal. You may need to correlate the software information you
find with the licensing distribution database (if you have one), which should list who has what
software, and what release levels and serial numbers should be present. If your company does not
have such a listing, keep in mind that bootlegged software on an employee's machine can subject
your company to hefty fines. Fines can be far in excess of the cost of obtaining a valid license.
When you click the Print… option, the panel in Exhibit 10 results. Note the bottom section of the
central panel. This is where you have the option of printing all the registry, or just a portion. If you
highlighted just a portion, you would see that branch of the registry in the Selected branch portion.
You will want to use the All function, however. Make sure it is selected (as in Exhibit 10) and click
the Print button at the bottom of the panel. Keep an eye on your paper supply and ink or toner
cartridge so that you get a good, clean, legible copy.
Exhibit 10: Regedit Printint Function
59
The different top−level branches of the system registry are as follows.
HKEY_CLASSES_ROOT
This is where different file extensions become registered so programs can interact with them. For
example, you might see an entry for .bmp. A file with a .bmp file extension would have an entry that
designates it as belonging to the image class of objects. You may also see an entry for what
program it is supposed to, by default, be opened with. Each known file extension on the system is
registered this way. Find the entry for the .doc extension. It belongs to the "application" content type
and, by default, is handled by the msword program, which is the file name for Microsoft Word
program in the Microsoft Office Suite.
You do not need to become an expert at reading every entry in the registry, and indeed, entire
books have been written on just working with the Windows system registry; rather, you should
become sufficiently familiar with things so that you can spot if something just does not look right. If
you have any doubts about an entry, consult an expert, preferably one versed in forensics and
cybernetic sleuthing.
HKEY_CURRENT_USER
Because you are logged on as the administrator (or an administrative level account), this registry
branch will contain the settings that were based on the preferences set up for that ID. This holds
information such as what image is on the Windows background (a.k.a. wallpaper), what font is set
as the users preference, etc. This is one entry that you can probably skip, but scan through it
anyway, just in case someone made a new entry in there that may not belong.
HKEY_LOCAL_MACHINE
This is where you may hit some real paydirt. The areas within this branch are for the machine's
configuration, including hardware and software loads, security, and other system level settings (see
Exhibit 8 for the branch headers).
60
If bootlegged software or other nonauthorized software was loaded, it will, in all likelihood, show up
in here in the Software branch. If the program is very old, it may not utilize the system registry for
everything, but may instead depend on text files to retain setting information. These text files were
referred to as .ini files (pronounced eye−en−eye), which stands for initialization files. This was the
common form of program preferences recording and setup information in the early days of Windows
3.x and was still actively used well into the use of Windows 95. Most current programs do not use
the .ini file concept, but work with the system registry due to it being the encouraged standard from
Microsoft. It is for this reason also that you should look for these .ini files wherever they may be on
the computer. Use the search function available from the Windows Start menu and search for all the
files ending in .ini. While most programs do not use them for their system settings, some programs
do still have them for backward compatibility, or because the developers of the software did not
want, or perhaps did not need, the sophistication of the system registry to support their application
in some areas.
HKEY_USERS
Under normal conditions, this portion of the system registry holds unique identifying information on
various identities registered on the system. These entries are normally generated by the computer
and do not normally contain information generated by the user directly. The information contained in
this area will look very cryptic. This is also a potential hiding spot for things, so be on the lookout. It
is difficult to say what a clever perpetrator might hide in here. Perhaps the perpetrator will keep a
record of unique system identifiers so he can spoof things. Perhaps he will not even use the registry
for this, but it is always a possibility that should not be ignored.
HKEY_CURRENT_CONFIG
Again, this area is generated by the computer and holds information about the current configuration
of various system level elements of the computer. Among these system elements you may find
certain switches for Microsoft products and Internet connections and options.
The author's advice is to look at system registry entries on corporate standard desktops that you
know have not been compromised. Become acquainted with what looks normal. Buy a good book
on the system registry and read up on its usage and parts. You do not have to become a
programmer by any means, but use the book as a guide for what is and is not supposed to be in an
area. It will help you understand a lot more about how to spot abnormal entries or subtle changes
that may indicate a problem.
Remember: if you are in doubt about an entry, it is best to involve an expert who can assist you.
Such an expert should not normally be from within your company information systems group, but
rather a person trained in forensic analysis as it pertains to computers. Your local law enforcement
agency should be able to either assist, or provide guidance as to whom in your area may be
qualified. Do not let ego stand in the way of a successful investigation.
Enabling and Using Auditing via the Windows Operating System
If you are lucky, and the suspect's computer is running either the Windows NT or Windows 2000
operating system, you may well be in luck in tracking activity on the suspect's computer. Part of
these operating systems features includes an auditing feature that can be extremely useful.
Before getting too excited, there are some prerequisites and a caveat you should heed. First, setting
up auditing properly and securely takes someone trained in the administration and security aspects
61
of the operating system involved. Second, this will only work on the two operating systems if the
suspect's computer is storing data on the hard drive where the hard drive is partitioned using the
NTFS file system. It is possible that the suspect's computer could be running the same file system
as Windows 95, Windows 98, or Windows ME, in which case no security would be available. The
non−secure file system (FAT16 and FAT32) was never designed to store security attributes about a
file or the users on the computer. On the Windows 95, 98, and ME operating systems, you could
establish a "Windows Password," but all it does is store desktop preferences such as wallpaper and
fonts, etc. A user can blast right past those logon screens by simply clicking the Cancel button on
the logon prompt and have full access to everything on that computer. The only protection a file has
on FAT16 or FAT32 includes the Read Only, Hidden, and System file attributes that could protect it
a little from prying eyes. While this may be great for you as an auditor examining someone's
computer running one of these computers, it is a gaping corporate security hole and does not afford
any level of real protection, or auditing capability. Tools that people can buy that supposedly "lock
down" the Windows 95, 98, or ME desktops are not really a deterrent. Those computers can still be
booted from a floppy diskette and then full access to the hard drive is possible. Their methods of
securely storing data usually involves setting up a series of Trojan files that redirect requests
through a program to where the real file is located, usually with an altered name and file extension,
and sometimes with altered file attributes to further try to hide the files.
As corporate policy, those computers capable of having the NTFS file system used on them should
be switched over to them. New computer installations should use this when initially configured, and
existing systems that do not yet have it should be switched over. There are tools available that will
allow you to easily change the partition file system without losing existing data or programs
(although a thorough backup should always be done before such a switch) from companies such as
PowerQuest Corporation (http://www.powerquest.com/). Their product, Partition Magic, is one of the
best in the industry and is the only one currently available that lets you switch both up to NTFS and
back to FAT16 or FAT32, with data in place.
The NTFS file was designed to be secure. This file system also tends to be more resistant to file
fragmentation. Remember the discussion of how the areas on a hard drive are like the hotel lobby
mailbox system? Well, say you have a lot of mail (i.e., a huge file), and the available areas in the
mailbox system (free places on the hard drive) are not contiguous in nature, meaning they have a
spot free here and there scattered throughout the filing system. What happens to the file to be
stored? Well, as you might have already guessed, it gets split up. It will become fragmented into as
many pieces as needed, and the file system will keep track of where each piece is. The more
fragmented a file becomes, the longer it takes to retrieve. This is often the cause of computer
performance degradation over time. What makes NTFS resistant to fragmentation is that the file
system management portion of the operating system will look at the size of the file to be stored and
try to find the largest available contiguous block of space it can to put it. While it is not going to
prevent fragmentation entirely, the degree of fragmentation is lower because of this more intelligent
handling. The FAT16 or FAT32 file systems simply start storing at the first empty spot and work
forward to store the file.
Fragmentation can make low−level data recovery efforts more difficult because of the need to track
down all the pieces. This is yet another reason to be using the more secure and more intelligently
managed NTFS file system in your organization.
One other feature available only on the Windows 2000 operating system is something called Folder
Redirection. This feature lets you have a hard drive folder, or even an entire hard drive, located
somewhere other than the user's local computer. This feature can be made transparent to the user
and is best used on desktop systems. Laptops that are potentially undocked and redocked (or
repeatedly disconnected and reconnected to the network) are not suitable for this entire drive
62
redirection because the location of the drive, not being local, would require synchronizing the files
back to the laptop over the network before undocking, and again once it was docked. The time
involved to do this level of synchronization is impractical. It is recommended, however, that you
consider redirecting the section of the system that contains the Event Logs so that the logs for a
computer are actually stored on a secure, remote server. This prevents tampering and provides an
easier way to make ongoing examinations of a given system. Setting this up will require some
expert administration skills; the details of this setup are beyond the scope of this text. Be aware,
however, of the capabilities and look into implementing this audit tracking and remote storage of the
logs if at all possible.
When you enable auditing, you cause entries to be made to an event log. On Windows NT and
Windows 2000, the Event Log Viewer (see Exhibit 11) is used to observe the entries made by the
auditing of activities. Event Logs are divided into three or four sections: System Messages,
Application Messages, Security Logs, and possibly IExplore (which contains auditing information on
Internet Explorer Events). The event viewer program is used by an administrator−level account on
either Windows NT or Windows 2000 to bring up these logs. The event viewer is split into two
panes, with the logging areas and the individual events listed. The amount of time an event log is
kept depends on the settings for the logs, which tell the computer when to overwrite the oldest
entries. If you are going to be monitoring someone over an extensive time frame, you may need to
make this a fairly large value.
Exhibit 11: Event Log Viewer General Screen
As you can see from the screen capture of a sample system in Exhibit 12, the auditing function can
capture as high or as low a degree of event granularity as you wish. Specific file and application
access can be audited, as well as logon and logoff times and other user activities. The entry
highlighted in Exhibit 11 shows a logon on event for a user on the computer. If you want to view the
exact contents of that event, you simply double−click to get more information about it and the detail
view will appear for that entry.
Exhibit 12: Event Log Viewer Logon Item Details
63
As seen in Exhibit 12, this particular entry shows a successful logon of the user under the account
shown. You can view the details of any event regardless of which portion of the logs they are in. If
you are auditing the use of a given application, for example, you can find out who invoked the
program, when it was started, etc.
The success of your auditing will depend on the expert invocation of the auditing feature, the
establishment of proper security configurations in your organization, and the vigilance with which
such monitoring of a suspect is carried out. Do not limit event logs to too small a size when tracking
someone for possible infractions of policy or the law. Such trespasses may not occur on a daily or
even weekly basis, so be prepared to maintain logs over a long monitoring duration. Do not forget
that these logs need to be backed up also. Separate backups should be made onto CD−R media
and that media should be kept tucked away in a secure, controlled environment with full chain of
custody provisions as per the federal and other local Rules of Evidence. Most default settings for
logs will make them overwrite after a few days or a week. The idea behind most default auditing is
not that of enforcement, but of debugging problems with a given computer system. It is up to you
and your corporate security team to ensure that monitoring via the auditing capability of the events
log is made efficacious.
More food for thought. You may actually have to initiate covert monitoring of someone in your own
group or on the corporate security team. Make sure you have sufficient processes and policies in
place to be able to monitor anyone. Remember: the computers in an organization belong to the
company and are corporate resources. The rights to privacy in the workplace and on the computer
are very limited, especially if your company gives notice to users when they log on that they are
subject to being monitored. If you suspect that the person who needs monitoring is a highly skilled
security expert, you are probably going to have to get expert help from an outside forensics and
security firm.
64
Confiscation of Computer Equipment
When you confiscate a computer, you should keep in mind all factors relating to Rules of Evidence
and establishing a custodial chain. From an evidential perspective, you will want to have the
computer isolated and secured as quickly as possible. There are a number of factors to consider
when impounding the equipment. First and foremost, make sure that when you impound it that you
have a secure location to bring it to. All your hard work will be for naught if it can be intimated in
court that unauthorized persons gained access to the computer and might have tampered with it.
Make certain you document the original state of the computer. This can and should include taking
date/time stamped photographs of the computer and its attached peripherals from all angles. If the
system is powered up when you arrive, photograph the screen. Make sure that you do this quickly,
as a password protected screen−saver may come on that will inhibit your ability to make a proper
shutdown of the system. Shut down the system following the normal Windows shutdown process.
Keep in mind that a clever individual may have put a Trojan horse program in place to destroy parts
of the system or evidence. This is another reason to have employed covert monitoring ahead of
time.
A sudden power down can be potentially damaging to the computer due to the loss of data from the
memory buffer that was not committed to the hard drive. Normally, a Windows shutdown writes all
unsaved buffer and disk cache to the hard drive as part of its shutdown process. Once the computer
is powered down, leave it off until you have made your bitstream backups. You should work only
from a similar computer that you set up from the restored bitstream backups made from the suspect
computer. Leave the suspect computer off if at all possible. If damage is to occur, it will happen to
the computer you are working off of, and that system can be restored again from the bitstream
backups if need be.
Tag all connections into the computer and even draw a diagram of the connections so that the
system can be put back together identically in the secure location. You will want to tag not only the
wire leading into the computer, but also the socket it goes into. Photographing the connection is
also a good idea once the tags are in place.
Make sure you protect the floppy diskette or other media drives. It is important that the read/write
heads of the floppy drive or other media not be misaligned due to handling damage. Many diskette
drives come packaged from their manufacturers with a cardboard insert, especially on older drives,
to protect the heads. If possible, use one for the floppy drive. If not, make sure the computer is
wrapped carefully (after fingerprints are taken if necessary), with shock−absorbent foam padding or
thickly wrapped in bubble wrap on all sides, prior to transport.
Make sure all personnel handling the equipment ground themselves first before touching the
chassis, components, and media. They should wear rubber−soled shoes and not wear any clothing
made of synthetic materials that can attract, or even generate, static electricity.
Remember that transporting the computer equipment is a prime area where the chain of custody
must be properly maintained. Transport should be performed by more than one person, and should
be direct from the suspect's site to the secure storage location. No single part of the equipment
should be let out of the sight and possession of at least two trusted and duly trained and authorized
people for even a moment. If you intend to go to court, you have to be able to prove that no
opportunity existed for the tampering, damage, or substitution of the evidence.
Make sure that once the equipment is brought to the secure location, that it is kept secure.
Tampering and damage prevention are critical, and the physical security of the lockup area must be
65
maintained. Video surveillance of the lockup area is recommended and should be in use while your
examination of the system is performed. This will help ensure that the defendant can perpetrate no
claims of poor process control or other bungling. If such surveillance is not feasible, then having an
expert witness present during your examination to cross−check your findings is also a valuable
resource.
Once your examination of the suspect's system is completed using the parallel computer, you
should fire up the suspect's computer and cross−check your results as a further point of evidence.
Other Methods of Covert Monitoring
Many computer programs exist that can spy on every keystroke, every window brought up, and
every e−mail sent, all without the knowledge of the person operating the computer. Such utilities
work at various levels and have a wide range of prices. One of the newest entries into the fray for
this is a program called SpectorSoft, made by SpectorSoft, Inc. (http://www.spectorsoft.com/). The
program, which costs less than under $100 as of this writing, takes intermittent snapshots of what is
being done on a computer. It maintains these logs of activity in great detail. One version of this
company's software will even covertly e−mail out the logs to an account you designate on a regular
basis. While it is not 100 percent unbreakable in terms of finding it, one would have to know exactly
when it was installed to be able to find it, and even then, it would be quite a chore to locate. It is just
one more weapon to consider in your arsenal of analysis and monitoring for illicit or illegal activity.
Other tools exist to monitor usage profiles of everything from Web browsing habits to e−mail.
Another vulnerability that new programs are also taking into account in their monitoring capabilities
is that of anonymous e−mail services available via the Web. Someone with a Hotmail or Yahoo!
e−mail account could send company−sensitive data out using these services and until now, there
was no good way to easily track and prosecute that. This is changing, thanks to these new tools. It
is difficult to block the use of Web−based e−mail due to the fact that many of the uses for such
e−mail systems are perfectly legitimate. A contractor might use such an e−mail account to keep in
touch with his or her company, for example. Such communications may be of a sensitive nature
between that individual and the company, and using a service such as Yahoo! or Hotmail keeps
their mail off the company's servers, reducing corporate workload and keeping corporate privacy
intact.
While your corporate firewall may not allow it, many companies do not block the protocols or ports
in the firewall to disallow communications via a chat program like AOL's Instant Messenger, Yahoo!
Messenger, ICQ, MSN Messenger, PowWow, IRC chat clients, or NetMeeting sessions. If your
company allows such messaging services to pass through the corporate firewall, remember that a
file can be sent out or received directly through these tools and it will bypass your e−mail scanning
protections. Corporate secrets could be revealed very quickly using these tools, and because it is
done without e−mail, yet a typed message is sent, it is easier to covertly send out messages like
this, but can be just as damaging as if someone picked up the phone and told it to the recipient
directly. A program that can capture keystrokes and screen shots will capture evidence of activity
like this, and can further enhance your stack of evidence. It should be used in conjunction with the
other tools mentioned, such as auditing through the operating system.
One other tool exists that can capture all data in or out of a computer. That tool is called a sniffer. A
sniffer can trap data packets as they are sent out from the computer and as they are received. It is
literally an intercept of the information traveling down the network wire, although it does not prevent
the transmission of such data in either direction. While it will not capture purely locally stored
information (information that never leaves the confines of the PC itself), anything that goes out of or
66
into the computer will be caught. Windows 2000 Server and Windows NT Server come with a
program that can remotely monitor any computer address and trap the data to and from it. While
designed as a tool for performance and trouble monitoring, it can be put into play for such
monitoring tasks. All that is needed is the Internet Protocol address (i.e., IP address) of the
computer to be monitored. Check with a trained Windows NT or Windows 2000 Administrator about
information on this tool and its use. It comes with the Server versions of both Windows NT and
Windows 2000.
Advanced spy equipment also exists that can monitor the minute electromagnetic fluxes coming
from the keyboard or the communications port of the computer. Such equipment, when used
properly, is another way to trap all data going into or coming out of a computer. This kind of
equipment is not inexpensive, and it will not work against computers hardened against electronic
eavesdropping (the government refers to this as an equipment's Tempest rating). But your average
computer will send out tons of impulses that can be captured from the wires and keypad buttons on
the keyboard and mouse, to the fluxes in the monitor screen and wires leading from the graphics
port of the computer.
An awareness of the tools available for the purposes of monitoring and collecting data is half the
battle of getting up and running effectively. Hopefully, this chapter was of aid in bringing about such
awareness and helping guide you to a successful implementation of your forensic detection and
investigation skills.
67
Chapter 4: Basics of Internet Abuse: What is Possible
and Where to Look Under the Hood
John W. Rado
The following material was developed with a specific objective: to assist an investigator, auditor,
security professional, or law enforcement professional in finding clues about a suspect's Internet
activities. This chapter does not attempt to be all−encompassing, but instead was developed to
assist the novice (as well as the seasoned professional) in becoming more aware of where to look
in, on, and around a computer for information and evidence.
Terms
We begin with the introduction of several key terms and their definitions. It is important for all
professionals working in this emerging field of cyber forensics to have a working and functioning
lexicon of terms that are uniformly applied throughout the profession and industry.
• Bookmarks: A quick way to revisit a Web site.
• Cookies: Cookies are a way that computers identify users. These cookies can change,
based on user direction and how Web sites are built. There are ways to defeat cookies, as
discussed later. A cookie is a text file that can be read only by the originating Web site,
unless several Web sites form an association whereby sites within the association can read
the others' cookie files. Cookies are stored on a computers hard drive. If you disable
cookies, then every time you visit a Web site, you will be asked to reregister as though that
was your first time at that site. If you have Internet Explorer as a browser, the Cookie Alert
tracks which sites have left cookies on your hard drive. Cookies are unique for each Web
site.
• DNS: Domain Name Server. Converts your request for information from an URL to an IP
address and tells your computer how to assemble Web page information. An URL is really a
collection of facts. Each fact is really a Web hit. The DNS tells the Web server application
how to send the URL (collection of facts) back to your computer and how your computer
should reassemble that information into the same format as seen on the Web page.
• History files: Show the titles of Universal Resource Locators (URLs) that someone has
visited. To view one, simply double−click on an URL in the History file of interest and the
computer will automatically drive to that Web location.
• IP address: Internet Protocol address. A numerical address by which computers interact on
the Internet. The IP address is made up of two parts: the identification number of the host
and the identification of the client.
• ISP: Internet service provider. A company that gives you access to the Internet.
• Logfile: A history of Web activity.
• TCP/IP: Transmission Control Protocol/Internet Protocol. Ensures that data sent from one
computer is sent correctly and notifies both sender and receiver if information is incorrect. It
is the basis of communication between computers everywhere.
• URL: Universal Resource Locator. This is the fancy name of a Web site. The URL name is
designed for people to recognize its source easier than by its IP address.
• Webhit: A request for an item on a Web page. This value is tracked to verify the usefulness
or popularity of a Web site.
68
Types of Users
One type of user only requests data and does not give personal data to a Web site. This kind of
user can only be tracked with regard to where that user went and how times that user went back. A
second type of user enters personal data at a Web site. The user's data is sent to the Web server
where it is analyzed and sends back information it thinks is pertinent to you.
E−Mail Tracking
E−mails can be deleted but are not erased from the hard drive until the computer overwrites the
exact space that that file filled. Software tools exist that can reassemble this data and other deleted
files if the space has not been overwritten.
IP Address Construction
Finding who owns an IP or Web address is relatively easy. IP addresses originate from one of three
Internet registry databases. Remember that IP addresses are a series of numbers.
The Internet Assigned Numbers Authority contacts the American Registry of Internet Numbers
(ARIN, http://www.arin.net/). ARIN distributes IP addresses in North and South America, the
Caribbean, and Sub−Saharan Africa. You can register your IP address with them. You can also find
information about IP addresses, not only where they are located but also who owns specific IPs.
This is done through their Web site and clicking on their link of "Whois." From there, you can search
for owners of IP addresses.
The other two registry databases are (1) the Asia Pacific Network Information Center (APNIC,
http://www.apnic.net/) and (2) the Reseaux IP Europeans (RIPE, http://www.ripe.net/).
Browser Tattoos
Both Netscape and Internet Explorer track user movements one way or another. Internet Explorer
5.0 alerts Web sites when a page is bookmarked. This function cannot be turned off. However,
when Internet Explorer searches Explorer, Explorer sends the search to Microsoft and then
Microsoft sends the search out to the search engines. The response of the search is routed back
through Microsoft and then back to your computer. Microsoft can cull the tattoos from your computer
for its use. Some versions of 4.0 even go so far as to reveal the user's name.
Netscape tracks user surfing by Smart Browsing (Exhibit 1) and "What's Related." (Exhibit 2).
Exhibit 1: Smart Browsing
69
Exhibit 2: Tracking "What's Related"
How an Internet Search works
Users type in a URL on the location bar. The user's PC contacts his ISP, who then searches the
Web. The request goes to a server, which based on the coding of the Web page (i.e., HTML [Hyper
Text Markup Language]), tells the server how to encode the Web page to the requesting computer.
Text and photos are sent separately to the requester's computer, in the form of packets (of
information) and reconstructed into a whole document at the requester's computer. The server
application tells how the Web site should send the information. The ISP tells the Web server which
ISP and which computer (the IP address) to send to. The server application tracks these requests in
a log file. These files can be examined at the ISP's site.
Netscape
What to look for: URLs — see bookmarks or location bar image files, files with .gif, or .jpg
extensions on the HD location bar (see Exhibit 3). The HD location bar stores all URLs that are
manually typed in, but not those from searches.
Exhibit 3: The Hard Drive Location Bar
70
If someone used a search engine, you can view the History file for a History Files (Exhibit 4). CTRL
H brings up the history window (Exhibit 5). Any URL of interest, regardless of how long ago it was
visited, can be re−seen simply by double−clicking on the URL in question.
Exhibit 4: Opening the History File
Exhibit 5: The History File
71
Cache is a storage area on the hard drive (HD). To access, simply type in "about:cache" in the
location bar. A great deal of information resides here. Click on a link shown to see pictures; click
again to see the image itself. It is tedious at best to scroll through the entire cache.
Another way to access the cache is to go to the Cache folder, through Find Files. In the Cache
folder are numerous files with unknown file names. Netscape randomly renames these vignettes of
pages with its own naming system and there is no rhyme or reason to it. The files in the cache can
be viewed by their size. Look for the .gif and .jpg files; they are what you are after. Ideally, image
sizes over 100 Kb should be viewed.
The simplest way to get to the Cache file is through Start, Find, Files or Folders. After selecting
Files or Folders, a window will appear; type "Cache" in the white block and hit Return. After the
computer searches the hard drive, a list will appear. This list contains every entry with Cache in it.
You are looking for a Cache Folder. When you double−click on the folder, a file will open and look
much like the window shown in Exhibit 6. In the lower left−hand corner, you will see an annotation of
how many objects are in that file and the total size of all the objects in that file. To select an
individual file, simply move your mouse to whichever file is of interest. In doing so, the size of the
selected file will appear in the lower left hand corner. From here, you can select all images that you
wish and not only see the size of the file, but also exactly what that file is.
Exhibit 6: The Cache Folder
Internet Explorer
Long Method: Location bar: Show Internet Explorer main page
History: Click on sundial (see Exhibit 7)
Exhibit 7: History by Site with Internet Explorer
72
Short Method: View button atop history window and select "By Site"
Cache: in Internet Explorer, this is called "Temporary Files." To get more out of the Temporary
Files: go to the Tools menu and select Internet Options (Exhibit 8), select "General" (Exhibit 9), and
click on "Temporary Internet Files" (Exhibit 10). If you click "Delete Files…," that will wipe out any
information of interest. Click on "Settings" to view the files (see Exhibit 11); this can be in the
thousands.
Exhibit 8: Internet Options
Exhibit 9: The "General" Tab
Exhibit 10: Temporary Internet Files Settings
73
Exhibit 11: Viewing Downloaded Program Files
Through Windows Explorer
Start button, Programs, Windows Explorer, View menu, select Details. This divides the display to
show file sizes, types, and dates, and the left side shows the folders. Make sure that the "C" drive is
open. Go to Windows folder, Temp Internet Folder, All Files. All Files in the Temp folder show up on
the right−hand side of the screen and also the Cookie files will show there. Look for large−size .jpg
and .gif extended files.
Swap Files
A special notepad is available when additional memory is needed in Windows 95/98. In Windows
NT, these are known as Page files. They can be 20 to 200 Mb or more in size. Remnants of word
documents, e−mail, Internet surfing, and just about anything else resides here. Swap files uses part
of the hard drive for memory. This file can be temporary or permanent and is set by the user. The
swap file in Windows95/98 is "win386.swp." This is also in the Root directory of the Virtual Memory
dialog box.
74
ISPs
The ISP server (ISPS) keeps track of when you got on the Internet, where you went, how long you
stayed, and how many times you have been back.
Servers
Webmasters can program an application to generate a report detailing the following information
from your computer:
• Your computer's IP address
• The number assigned to a specific user and the password
• URL or graphics accessed
• Whether or not the page requested was received
• How much data was sent from the requester's computer and compared to how much was
sent back
• Other URLs visited
• User's ISP and the browser type (Netscape or Internet Explorer)
• Cookie filenames
• Your computer's operating system
• How long you visited a site and how many times you have been back
If you are a registered user, the server can reveal your password and will probably make a guess as
to the users demographics and suggest advertisement channelled to the user based on its
knowledge of those demographics.
Server snooping software includes Little Brother, Surf Watch, Checkpoint Firewall 1, Internet
Manager, and Cyber Snoop.
Keylogger records every keystroke made by a user on a computer having such installed on it.
Works Cited
1. Anderson, Heidi, Gathering Information: Techniques for Learning More about Who Is Viewing a
Website, PC Today, Nov. 97, Vol. 11, Issue 11.
http://www.smartcomputing.com/editorial/ar…day/goingonline/971137b.html&guid+1lhmvh50
2. Dichter, Mark S. and Michael S. Burkhardt, Electronic Interaction in the Workplace: Monitoring,
Retrieving and Storing Employee Communications in the Internet Age. Morgan Lewis.
3. http://www.morganlewis.com/art61499.htm.
4. "How Do They Spy on You,"
wysiwyg://30/http://netsecurity.ab…urity/library/weekly/aa082100b.htm
5. Trumble, Chris, Understanding IP Addresses, PC Privacy, Apr. 2000, Vol. 8, Issue 4.
http://www.smartcomputing.com/editorial/…earchtype=0&WordList=%22tracking+URLs%
6. Levine, Diane E., All−Knowing Numbers: Computer Mechanisms Reveal Users' Private Data,
Smart Computing, Sept. 99, Vol. 10, Issue 9.
http://www.smartcomputing.com/editorial/…earchtype=0&WordList=%22tracking+URLs%
7. Mann, Richard, Find Out What Your Kids Are Doing on the Internet, 8 Aug 00.
wysiwyg://6/http://www.themestream…gsp?c_id=46807&id_list=&cookied=T
75
8. Mann, Richard, Checking up on Netscape Navigator Users, 8 Aug 00.
wysiwyg://8/http://www.themestream.com/articles/46815.html
9. Mann, Richard, Checking up on Microsoft Internet Explorer Users, 8 Aug 00.
wysiwyg://11/http://www.themestream.com/articles/16873.html
10. Windows Swap File Defined, New Technologies Inc., http://www.forensics−intl.com/def7.html
11. Phelps, Alan, Address Bar, Learning Series, Internet Tools, Feb. 00, Vol. 6, Issue 2,
http://www.smartcomputing.com/editorial/…3rlf0&searchtype=0&WordList=URL+Tracki.
12. Sherman, Chris, How to Make History,
Wysiwyg://9/http://websearch.about.com/i…tm?iam=dpile&terms=%2B%22URL+tracking%
13. Nelson, Michelle, Web Tracking is Watching You: Log Files and Cookies Record Your Actions
and Anticipate Your Interests, Smart Computing, Reference Series, How Computers Work, Nov. 99,
Vol. 3, Issue 4.
http://www.smartcomputing.com/editorial/…3rlr0&searchtype=0&WordList=URL+Tracki
14. Nelson, Michelle, Web Tracking Is Watching You: Log Files and Cookies Record Your Actions
and Anticipate Your Interests, Smart Computing, Guide Series, PC Privacy, Apr. 00, Vol. 8 Issue 4.
http://www.smartcomputing.com/editorial/…3rlr0&searchtype=0&WordList=URL=Tracki
15. Nelson, Michelle, Web Tracking Is Watching You: Log Files and Cookies Record Your Actions
and Anticipate Your Interests, Smart Computing, Reference Series, How the Internet Works, Part I,
Feb. 01, Vol. 5, Issue 1.
http://www.smartcomputing.com/editorial/…3rlr0&searchtype=0&WordList=URL=Tracki
76
Chapter 5: Tools of the Trade: Automated Tools Used
to Secure a System Throughout the Stages of a
Forensic Investigation
Overview
Brent Deterdeing
This chapter addresses, discusses, and examines the tools used to secure a system throughout all
stages of an incident. It also analyzes and groups these tools into three distinct groups: detection,
protection, and analysis tools. Detection tools are used before and after an incident to identify risk,
while protection tools are used to mitigate that risk, and analysis tools are used to measure risk.
So what is the risk? Security professionals utilize the following risk model in assessing risk:
• [(Criticality + Lethality) − (Network countermeasures + Host−based countermeasures)]
The entire methodology of risk assessment will be best left for another text. However, several good
examples of texts dealing with risk assessment can be found in Appendix B. Keep this model in
mind as the risks that both systems and networks face are discussed.
Detection Tools
Detection tools are used to identify risks. The analysis of detection tools begins with network−based
tools. Network−based tools evaluate one host from another host using the network. There several
are unique issues when dealing with network tools; however, this chapter investigates these in
terms of one such tool — Nmap. Nmap is the most widely used tool for such network analysis.
Of the network tools available to users, by far the most useful, versatile, and common is nmap.
Nmap is such a commonly used and widespread tool that indepth coverage of this tool is warranted
here, as are some of the issues surrounding it.
Nmap (available at http://www.insecure.org/) is the commonly accepted authority in
information−gathering tools. It is the first tool that both an attacker and a defender reaches for, and
for good reason. It is an extremely versatile and useful information−gathering tool that yields much
of the necessary information about a machine and its possible weaknesses. However, care must be
taken when using Nmap, as we shall see.
Nmap began as a port scanner, intended to aid in the mapping (identifying) of possible security
holes on a system or set of systems. According to http://www.insecure.org/:
Nmap is a utility for port scanning large networks, although it works fine for single
hosts. Sometimes you need speed, other times you may need stealth. In some
cases, bypassing firewalls may be required. Not to mention the fact that you may
want to scan different protocols (UDP, TCP, ICMP, etc.).
Nmap can specify a machine or set of machines via IP address, DNS name, or network number,
and can connect to those machine(s) via TCP connect, TCP SYN, TCP FIN, TCP Xmas, TCP
77
NULL, TCP bounce, TCP ACK, UDP ICMP, ICMP, TCP, and direct RPC. Nmap can fragment
packets in several timing schemes to further thwart firewalls that may count the number of packets
over a given time period.
One of Nmap's signature features is operating system (OS) detection. OS detection is accomplished
through TCP/IP fingerprinting. TCP/IP fingerprinting works by sending a series of nonstandard
packets to an operating system and then seeing what is returned. This fingerprint is matched to a
database that ships with Nmap and contains several hundred operating system "fingerprints." Nmap
also supports features such as dynamic ttl times, parallel scanning and pinging, flexible target and
port specification, decoy scanning, and output to text or machine−readable formats.
Nmap is an open−source project, meaning that its source code is freely available to look at, modify,
and use at one's will. Nmap is available on many operating systems simply because users of those
operating systems took the code and ported it to the OS of their choice. Being open−source, Nmap
is, of course, free. Although free, it offers more functionality and better performance than its pricey
brethren. Nmap is in wide use by anyone needing information on a system, be they the system
administrators or someone attempting to attack or otherwise compromise a system.
Fyodor, a self−proclaimed hacker, wrote Nmap as a port scanning tool, as described above. Fyodor
r e c e n t l y g a v e a n i n t e r v i e w t o S e c u r i t y F o c u s . c o m
(www.securityfocus.com/>Audio/Visual−>Interviews−>Fyodor). In this interview, Fyodor stated one
use of Nmap that he found most gratifying was its use to find proxies to bypass censorship, as was
experienced and the case in China several years ago. Nmap, however, has many other uses, which
include both (arguably) "good" and "bad" uses. Fyodor also mentioned in this interview that Nmap
can develop into a full−blown, commercially available vulnerability scanning utility, while keeping the
existing features in the free tool. Also discussed in the interview was a version for Windows NT,
which recently became available from Eeye Security, and can be found at
www.eeye.com/html/Databases/Software/nmapnt.html. Fyodor will gladly accept an NT port for
Nmap, although he will not develop it himself. Again, from http://www.insecure.org/:
All my programming work is for UNIX as I believe Windows 98/NT is still too primitive
for power users. I also believe that Microsoft intentionally engages in
anti−competitive and ethically challenged actions, which can have devastating results
for the industry and consumers.
SecurityFocus.com asked Fyodor if he was concerned about a rumor stating that Nmap could be
banned by the government. The possibility has been discussed in mailing lists and open forums.
However, Fyodor commented that he saw no need to worry over this perceived threat, as he does
not believe that Nmap could be banned, due to its large dissipation and the fact that it is
open−sourced code.
Fyodor's vision of a hacker is a person with a passion for technology and exploring its limits. This
would apply to those who find and publish security holes (gray−hats), as well as those hackers who
commit crimes using the information (black−hats), although they are not hackers because they
committed crimes, but because of the skills they used to commit them.
Fyodor has a distinct dislike for "script kiddies." It has been argued that tool authors such as Fyodor
are responsible for script kiddies having the success that do. However, system administrators
(white−hats) need security scanners, despite the fact that attackers can use those same tools to
uncover security holes. Is it better to expose security holes until they get fixed or to not have tools
such as Nmap available, thus making holes harder to find? It is commonly accepted that security
through obscurity is really no security at all. Fyodor agrees with this assessment, and went on to
78
state that he thinks script kiddies have actually helped the security field, as they are constantly
scanning networks and finding holes.
This constant scanning reveals holes that are occasionally exploited, typically with the consequence
of a company's public embarrassment. However, these holes are often quickly fixed, leaving them
closed for other potentially more dangerous attackers such as corporate espionage or malicious
intruders. This also increases the likelihood of other holes being discovered by both the victim
company and other companies/organizations before they can be exploited.
Although security through obscurity is no security at all, there is an argument that the large volume
of exploits made known does more to harm security then it does to help it. Fyodor argued that it is
this large volume of exploits that has brought a higher understanding and concern of security
issues. He pointed out the state of affairs several years ago: when compared to today, we are much
more secure. That is, companies are taking more responsibility to make their products more secure.
For example, consider Microsoft. Compare the security offered in Windows 95 vs. the security
offered in Windows NT.
Clearly, steps have been taken in the right direction in the past several years. In future versions of
Nmap, expect to see socks proxy bounce scanning, IP ID scanning, traceroute support, more input
and output forms, faster scans, Solaris binaries (à la RPMs), an improved front end, a default
configuration file (.nmaprc), and making Nmap a shared library.
Nmap is, without dispute, a very powerful tool that has many uses for the white−, gray−, and
black−hats of the security community. There are, however, several important factors to consider
before using Nmap to scan a single machine or a large network. Although port scanning is legal (in
the United States), it is not "nice." Scans from unauthorized sources can be deemed as an invasion
with unpredictable results.
A recent experience with Nmap can be used as an example. The task was to scan a class B
network to see what could be found. Not having much experience with Nmap nor with data retrieval,
several precautions were taken to preserve data on the production−level system.
Permission to conduct the Nmap test was obtained from the networking supervisor, as well as from
the chief security officer, whose responsibilities included network scanning. The option selected for
this test was to perform a full scan with TCP SYN packets on the default timing.
The scan was run three times per week and the results were used to gather any useful information.
Several illegal ftp sites were shut down and some OS accounting information was gathered.
However, several people noticed the scan, which had come unannounced to them. Management
was aware of the scan, the security officer knew, but no one else did. Better care should have been
taken to publish the scan to those who would notice it (such as, "We will be scanning you sometime
this month."). Although useful information was gained, it was less than well received by clients and
the test organization as a whole.
A well−documented, narrow scan should have been performed, as opposed to a full "scan
everything" approach. The scan resulted in several unpredictable events. Many people had
personal firewalls in place and saw the test scans as an attack. Not only did users flood the security
officer with demands for a cease to the scan test, but they also retaliated.
No one did anything very malicious, but they let the tester know that they got in and did not
appreciate the test scans. Another nasty side effect of the scan using Nmap was that some older
machines crashed as a direct result of their being scanned. The crashed machines were later fixed,
79
but the scan interrupted batch jobs on several servers.
Thus, seemingly innocuous scans had wide−ranging implications that impacted many people and
did little to foster a positive image of general security within the test organization. Overall, some
useful information was gleaned from the scans, but no more than could be gained from a simple
scan that is much less invasive. Scanning is a job that any security officer should perform on a
routine basis. However, care should be taken not to adversely affect anyone and to acquire prior
written authorization. In this manner, scanning can yield many benefits without having any adverse
effects on operations or personnel.
Previously, it was mentioned that Nmap arguably has both good and bad uses. The good uses of
Nmap are apparent. Nmap is a very powerful information−gathering tool that helps many security
professionals on a daily basis. However, it can also be argued that Nmap has features that provide
for bad uses. In this context, a bad use is one that holds benefit for attackers and nothing but
detriment for defenders. One such feature that could be argued to provide a bad use is the ability of
Nmap to fragment packets, coupled with timings that send very few packets spread over a long
period of time.
When packets are fragmented and very seldom come through, a firewall or intrusion−detection
device is unlikely to notice anything suspicious. The slow timing ensures that no alarms go off by
having a large number of packets, a large amount of data, or connections to many ports of a single
device or port in a given period of time. Fragmenting the packets allows an attacker to possibly
sneak packets through a firewall by confusing/bypassing packet filters.
Because packet filters only look at the first fragment of a packet, attackers can conceal data with
overlapping fragments and headers. This can be useful for a distributed denial−of−service (DDoS)
attack. Another feature of Nmap, which falls under the bad use category, is Nmap's ability to
generate many false scans, which divert attention from the true scan. These bad uses certainly
benefit the attacker community, but do they help the good guys? Is this not security through
obscurity? To a point, yes it is. Yet, if fragmentation were not incorporated into Nmap, would it leave
a security hole open? Perhaps it would.
Of what use is decoy scanning to a defender? There is no good use of decoy scanning to a
defender. So perhaps fragmentation is a good thing; it makes us prepare for the real−world
possibility of dealing with fragmentation and seal a possible security hole. However, some would
argue that decoy scanning is a feature that Nmap does not need, as it only serves to benefit the
attacker and be a detriment to the defender. There are other such features in Nmap that are not
mentioned here. These two examples were chosen to help illustrate that some features in Nmap,
which may appear to be harmful, may actually be a good feature after all (e.g., fragmentation), while
other aspects of Nmap such as decoy scanning may continue to be regarded as undesirable
features to include in such a product as Nmap.
Exhibit 1 shows that Nmap has a very functional front end and offers the user many options for
scanning. One sees the many options for scanning that Nmap presents, as well as some standard
output. Nmap documentation is excellent and provides clear and concise explanations for both
scanning options and output formats.
Exhibit 1: Nmap
80
Nmap, however wonderful it may be, is not a panacea. A free, open−sourced tool that runs under
Linux complements Nmap extremely well. It is called Nessus (see Exhibit 2) and is available at
www.nessus.org/. Nessus scans a host for specific exploits that may be present on the machine.
Nessus is a vulnerability scanner that is superior to most, if not all, commercial products. It operates
as a client/server model and has an excellent graphical user interface (GUI).
Exhibit 2: Nessus
81
Exhibit 2 provides a portion of the type of exploits that Nessus looks for. One of Nessus' greatest
strengths is in its ability to do both technical and executive reporting that rivals other commercial
products. A typical Nessus report would look like the one in Exhibit 3.
Exhibit 3: Nessus Report
Nessus is a wonderful general−purpose vulnerability scanner. Windows−based alternatives exist,
but can run upward of $12,000 per year. Another excellent scanner is Retina by eEye Securities
and can be found at www.eeye.com/. At times, a more specific tool is used for a specific host. For
example, if auditing a Web server for vulnerabilities, one may first run Nmap, then Nessus, and
follow up with a scan from whisker (www.wiretrip.net/rfp/p/doc.asp?id=21&iface=2). Whisker is an
82
excellent scanner written by Rain Forest Puppy that looks specifically for cgi vulnerabilities. It does
not have a Windows−based equivalent, although many vulnerability scanners duplicate some of its
functionality.
Another specific tool that is frequently used is Firewalk. Firewalk, available at
http://packetfactory.net/Projects/Firewalk/, employs traceroute−like techniques to analyze IP packet
responses to determine gateway ACL filters and map networks. In essence, it sends packets at a
system behind a firewall with incrementing ttl values to determine what ports on a packet−filtering
device are open. Firewalk does not have a Windows−based equivalent. It does have a fairly
easy−to−use GUI, as seen in Exhibit 4.
Exhibit 4: Firewalk
The above four tools are extremely capable tools and are used by both attackers and defenders for
the same purpose: to discover what vulnerabilities exist on a system that may be exploited.
However, the defenders have another avenue not typically available to attackers: the ability to work
on the system. It is this avenue that must be pursued by security−conscious system and security
administrators to protect their systems. These tools that run directly on a system are referred to as
host−based tools.
Tripwire is a file and directory integrity checker available at http://www.tripwire.com/
or
Recovering and Examining Computer Forensic Evidence
Michael G. Noblett, Mark M. Pollitt, and Lawrence A. Presley, in Forensic Science Communication,
Volume 2, Issue 4, October 2000
Introduction
The world is becoming a smaller place in which to live and work. A technological revolution in
communications and information exchange has taken place within business, industry, and our
homes. America is substantially more invested in information processing and management than
manufacturing goods, and this has affected our professional and personal lives. We bank and
transfer money electronically, and we are much more likely to receive an e−mail than a letter. It is
estimated that the worldwide Internet population is 349 million (CommerceNet Research Council
2000).
In this information technology age, the needs of law enforcement are changing as well. Some
traditional crimes, especially those concerning finance and commerce, continue to be upgraded
technologically. Paper trails have become electronic trails. Crimes associated with the theft and
manipulations of data are detected daily. Crimes of violence also are not immune to the effects of
the information age. A serious and costly terrorist act could come from the Internet instead of a truck
bomb. The diary of a serial killer may be recorded on a floppy disk or hard disk drive rather than on
paper in a notebook.
Just as the workforce has gradually converted from manufacturing goods to processing information,
criminal activity has, to a large extent, also converted from a physical dimension, in which evidence
and investigations are described in tangible terms, to a cyber dimension, in which evidence exists
only electronically, and investigations are conducted online.
Computer Forensic Science
Computer forensic science was created to address the specific and articulated needs of law
enforcement to make the most of this new form of electronic evidence. Computer forensic science is
the science of acquiring, preserving, retrieving, and presenting data that has been processed
electronically and stored on computer media. As a forensic discipline, nothing since DNA
technology has had such a large potential effect on specific types of investigations and prosecutions
134
as computer forensic science.
Computer forensic science is, at its core, different from most traditional forensic disciplines. The
computer material that is examined and the techniques available to the examiner are products of a
market−driven private sector. Furthermore, in contrast to traditional forensic analyses, there
commonly is a requirement to perform computer examinations at virtually any physical location, not
only in a controlled laboratory setting. Rather than producing interpretative conclusions, as in many
forensic disciplines, computer forensic science produces direct information and data that may have
significance in a case. This type of direct data collection has wide−ranging implications for both the
relationship between the investigator and the forensic scientist and the work product of the forensic
computer examination.
Background
Computer forensic science is largely a response to a demand for service from the law enforcement
community. As early as 1984, the FBI Laboratory and other law enforcement agencies began
developing programs to examine computer evidence. To properly address the growing demands of
investigators and prosecutors in a structured and programmatic manner, the FBI established the
Computer Analysis and Response Team (CART) and charged it with the responsibility for computer
analysis. Although CART is unique in the FBI, its functions and general organization are duplicated
in many other law enforcement agencies in the United States and other countries.
An early problem addressed by law enforcement was identifying resources within the organization
that could be used to examine computer evidence. These resources were often scattered
throughout the agency. Today, there appears to be a trend toward moving these examinations to a
laboratory environment. In 1995, a survey conducted by the U.S. Secret Service indicated that 48
percent of the agencies had computer forensic laboratories and that 68 percent of the computer
evidence seized was forwarded to the experts in those laboratories. As encouraging as these
statistics are for a controlled programmatic response to computer forensic needs, the same survey
reported that 70 percent of these same law enforcement agencies were doing the work without a
written procedures manual (Noblett 1995).
Computer forensic examinations are conducted in forensic laboratories, data processing
departments and, in some cases, the detective's squad room. The assignment of personnel to
conduct these examinations is based often on available expertise, as well as departmental policy.
Regardless of where the examinations are conducted, a valid and reliable forensic examination is
required. This requirement recognizes no political, bureaucratic, technological, or jurisdictional
boundaries.
There are ongoing efforts to develop examination standards and to provide structure to computer
forensic examinations. As early as 1991, a group of six international law enforcement agencies met
with several U.S. federal law enforcement agencies in Charleston, South Carolina, to discuss
computer forensic science and the need for a standardized approach to examinations. In 1993, the
FBI hosted an International Law Enforcement Conference on Computer Evidence that was attended
by 70 representatives of various U.S. federal, state, and local law enforcement agencies and
international law enforcement agencies. All agreed that standards for computer forensic science
were lacking and needed. This conference again convened in Baltimore, Maryland, in 1995,
Australia in 1996, and the Netherlands in 1997, and ultimately resulted in the formation of the
International Organization on Computer Evidence. In addition, a Scientific Working Group on Digital
Evidence (SWGDE) was formed to address these same issues among federal law enforcement
agencies.
135
A New Relationship
Forensic science disciplines have affected countless criminal investigations dramatically and have
provided compelling testimony in scores of trials. To enhance objectivity and to minimize the
perception of bias, forensic science traditionally has remained at arms length from much of the
actual investigation. It uses only those specific details from the investigation that are necessary for
the examination. These details might include possible sources of contamination at the crime scene
or fingerprints of individuals not related to the investigation who have touched the evidence.
Forensic science relies on the ability of the scientists to produce a report based on the objective
results of a scientific examination. The actual overall case may play a small part in the examination
process. As a case in point, a DNA examination in a rape case can be conducted without
knowledge of the victim's name, the subject, or the specific circumstances of the crime.
Conversely, computer forensic science, to be effective, must be driven by information uncovered
during the investigation. With the average storage capacity in a personally owned microcomputer
approaching 30 gigabytes (GB; Fischer 1997), and systems readily available that have 60−GB
storage capacity or more, it is likely to be impossible from a practical standpoint to completely and
exhaustively examine every file stored on a seized computer system. In addition, because
computers serve such wide and varied uses within an organization or household, there may be legal
prohibitions against searching every file. Attorney or physician computers may contain not only
evidence of fraud but probably also client and patient information that is privileged. Data centrally
stored on a computer server may contain an incriminating e−mail prepared by the subject as well as
e−mail of innocent third parties who would have a reasonable expectation of privacy.
As difficult as it would be to scan a directory of every file on a computer system, it would be equally
difficult for law enforcement personnel to read and assimilate the amount of information contained
within the files. For example, 12 GB of printed text data would create a stack of paper 24 stories
high. For primarily pragmatic reasons, computer forensic science is used most effectively when only
the most probative information and details of the investigation are provided to the forensic examiner.
From this information, the examiner can create a list of key words to cull specific, probative, and
case−related information from very large groups of files. Even though the examiner may have the
legal right to search every file, time limitations and other judicial constraints may not permit it. The
examination in most cases should be limited to only well−identified probative information.
Forensic Results
Forensic science has historically produced results that have been judged to be both valid and
reliable. For example, DNA analysis attempts to develop specific identifying information relative to
an individual. To support their conclusions, forensic DNA scientists have gathered extensive
statistical data on the DNA profiles from which they base their conclusions. Computer forensic
science, by comparison, extracts or produces information. The purpose of the computer
examination is to find information related to the case. To support the results of a computer forensic
examination, procedures are needed to ensure that only the information exists on the computer
storage media, unaltered by the examination process. Unlike forensic DNA analysis or other
forensic disciplines, computer forensic science makes no interpretive statement as to the accuracy,
reliability, or discriminating power of the actual data or information.
Beyond the forensic product and the case−related information needed to efficiently perform the
work, there is another significant difference between most traditional forensic science and computer
forensic science. Traditional forensic analysis can be controlled in the laboratory setting and can
progress logically, incrementally, and in concert with widely accepted forensic practices. In
comparison, computer forensic science is almost entirely technology and market driven, generally
outside the laboratory setting, and the examinations present unique variations in almost every
136
situation.
Common Goals
These dissimilarities aside, both the scientific conclusions of traditional forensic analyses and the
information of computer forensic science are distinctive forensic examinations. They share all the
legal and good laboratory practice requirements of traditional forensic sciences in general. They
both will be presented in court in adversarial and sometimes very probing proceedings. Both must
produce valid and reliable results from state−of−the−art procedures that are detailed, documented,
and peer−reviewed and from protocols acceptable to the relevant scientific community (ASCLD/LAB
1994).
As laboratories begin to examine more computer−related evidence, they must establish policies
regarding computer forensic examinations and, from these policies, develop protocols and
procedures. The policies should reflect the broad, community−wide goal of providing valid and
reproducible results, even though the submissions may come from diverse sources and present
novel examination issues. As the laboratory moves from the policy statement to protocol
development, each individual procedure must be well−documented and sufficiently robust to
withstand challenges to both the results and methodology.
However, computer forensic science, unlike some of its traditional forensic counterparts, cannot rely
on receiving similar evidence in every submission. For example, DNA from any source, once
cleared of contaminants and reduced to its elemental form, is generic. From that point, the protocols
for forensic DNA analysis may be applied similarly to all submissions. The criminal justice system
has come to expect a valid and reliable result using those DNA protocols. For the following reasons,
computer forensic science can rarely expect these same elements of standardized repetitive testing
in many of its submissions:
• Operating systems, which define what a computer is and how it works, vary among
manufacturers. For example, techniques developed for a personal computer using the Disk
Operating System (DOS) environment may not correspond to operating systems such as
UNIX, which are multiuser environments.
• Applications programs are unique.
• Storage methods may be unique to both the device and the media.
Typical computer examinations must recognize the fast−changing and diverse world in which the
computer forensic science examiner works.
Examining Computer Evidence
Computer evidence represented by physical items such as chips, boards, central processing units,
storage media, monitors, and printers can be described easily and correctly as a unique form of
physical evidence. The logging, description, storage, and disposition of physical evidence are well
understood. Forensic laboratories have detailed plans describing acceptable methods for handling
physical evidence. To the extent that computer evidence has a physical component, it does not
represent any particular challenge. However, the evidence, while stored in these physical items, is
latent and exists only in a metaphysical electronic form. The result that is reported from the
examination is the recovery of this latent information. Although forensic laboratories are very good
at ensuring the integrity of the physical items in their control, computer forensics also requires
methods to ensure the integrity of the information contained within those physical items. The
challenge to computer forensic science is to develop methods and techniques that provide valid and
reliable results while protecting the real evidence — the information — from harm.
137
To complicate the matter further, computer evidence almost never exists in isolation. It is a product
of the data stored, the application used to create and store it, and the computer system that directed
these activities. To a lesser extent, it is also a product of the software tools used in the laboratory to
extract it.
Computer forensic science issues must also be addressed in the context of an emerging and rapidly
changing environment. However, even as the environment changes, both national and international
law enforcement agencies recognize the need for common technical approaches and are calling for
standards (Pollitt 1998). Because of this, a model (see Exhibit 1) must be constructed that works on
a long−term basis even when short−term changes are the rule rather than the exception. The model
that we describe is a three−level hierarchical model consisting of the following:
• An overarching concept of the principles of examination,
• Policies and practices, and
• Procedures and techniques.
Exhibit 1: Recovering and Examining Computer Forensic Evidence: A Three−Level Hierarchical
Model for Developing Guidelines for Computer Forensic Evidence
Principles of examinations are large−scale concepts that almost always apply to the examination.
They are the consensus approaches as to what is important among professionals and laboratories
conducting these examinations. They represent the collective technical practice and experience of
forensic computer examiners.
Organizational policy and practices are structural guidance that applies to forensic examinations.
These are designed to ensure quality and efficiency in the workplace. In computer forensic science,
these are the good laboratory practices by which examinations are planned, performed, monitored,
recorded, and reported to ensure the quality and integrity of the work product.
Procedures and techniques are software and hardware solutions to specific forensic problems. The
procedures and techniques are detailed instructions for specific software packages as well as
step−by−step instructions that describe the entire examination procedure (Pollitt 1995).
As an overall example, a laboratory may require that examinations be conducted, if possible and
practical, on copies of the original evidence. This requirement is a principle of examination. It
represents a logical approach taken by the computer forensic science community as a whole, and it
is based on the tenet of protecting the original evidence from accidental or unintentional damage or
alteration. This principle is predicated on the fact that digital evidence can be duplicated exactly to
create a copy that is true and accurate.
Creating the copy and ensuring that it is true and accurate involves a subset of the principle, that is,
policy and practice. Each agency and examiner must make a decision as to how to implement this
138
principle on a case−by−case basis. Factors in that decision include the size of the data set, the
method used to create it, and the media on which it resides. In some cases it may be sufficient to
merely compare the size and creation dates of files listed in the copy to the original. In others, it may
require the application of more technically robust and mathematical rigorous techniques such as a
cyclical redundancy check (CRC) or calculating a message digest (MD).
CRC and MD are computer algorithms that produce unique mathematical representations of the
data. They are calculated for both the original and the copy and then compared for identity. The
selection of tools must be based on the character of the evidence rather than simply laboratory
policy. It is likely that examiners will need several options available to them to perform this one
function.
An examiner responsible for duplicating evidence must first decide an appropriate level of
verification to weigh time constraints against large file types. The mathematical precision and
discriminating power of these algorithms are usually directly proportional to the amount of time
necessary to calculate them. If there were [one] million files to be duplicated, each less than [one]
kilobyte in size, time and computational constraints would likely be a major determining factor. This
circumstance would probably result in a decision to use a faster, but less precise and discriminating,
data integrity algorithm.
Having decided how best to ensure the copy process will be complete and accurate, the next step is
the actual task. This is a subset of the policy and practice, that is, procedures and techniques.
These most closely represent the standard cookbook approach to protocol development. They are
complete and contain required detailed steps that may be used to copy the data, verify that the
operation was complete, and ensure that a true and accurate copy has been produced.
Again, as Exhibit 1 illustrates, a principle may spawn more that one policy, and those policies can
accept many different techniques. The path an examiner takes in each case is well−documented
and technologically sound for that particular case. It may not, however, be the same path the
examiner takes with the next case. Traditional forensic examinations, such as the DNA examination
of blood recovered from a crime scene, lend themselves to a routine and standardized series of
steps that can be repeated in case after case. There is generally no such thing as generic computer
evidence procedures. The evidence is likely to be significantly different every time a submission is
received by the laboratory and will likely require an examination plan tailored to that particular
evidence. Although this situation may present a recurrent consideration of management checks and
controls within the laboratory setting, it is a consideration that must be addressed and improved if
this emerging forensic discipline is to remain an effective and reliable tool in the criminal justice
system.
Conclusion
Valid and reliable methods to recover data from computers seized as evidence in criminal
investigations are becoming fundamental for law enforcement agencies worldwide. These methods
must be technologically robust to ensure that all probative information is recovered. They must also
be legally defensible to ensure that nothing in the original evidence was altered and that no data
was added to or deleted from the original. The forensic discipline of acquiring, preserving, retrieving,
and presenting data that has been processed electronically and stored on computer media is
computer forensic science.
This chapter examined issues surrounding the need to develop laboratory protocols for computer
forensic science that meet critical technological and legal goals. Computer forensic scientists need
to develop ongoing relationships with the criminal justice agencies they serve. The reasons for
139
these relationships include the following:
• In their efforts to minimize the amount of data that must be recovered and to make their
examinations more efficient and effective, computer forensic scientists must have specific
knowledge of investigative details. This is a clear requirement that is generally more
demanding than traditional forensic science requests, and it places more reliance on case
information.
• Courts are requiring that more information rather than equipment be seized. This requires
cooperative efforts between law enforcement officers and the computer forensic scientist to
ensure that the technical resources necessary for the execution of the search warrant are
sufficient to address both the scope and complexity of the search.
• Computers may logically contain both information identified in the warrant as well as
information that may be constitutionally protected. The computer forensic scientist is
probably the most qualified person to advise both the investigator and prosecutor as to how
to identify technical solutions to these intricate situations.
Developing computer examination protocols for forensic computer analysis is unique for several
reasons:
• Unlike some traditional forensic analyses that attempt to gather as much information as
possible from an evidence sample, computer forensic analysis attempts to recover only
probative information from a large volume of generally heterogeneous information.
• Computer forensic science must take into account the reality that computer forensic science
is primarily market driven, and the science must adapt quickly to new products and
innovations with valid and reliable examination and analysis techniques.
• The work product of computer forensic science examinations also differs from most
traditional forensic work products. Traditional forensic science attempts to develop a series
of accurate and reliable facts. For example, the DNA extracted from blood found at a crime
scene can be matched to a specific person to establish the fact that the blood was shed by
that person to the exclusion of all other individuals. Computer forensic science generally
makes no interpretive statement as to the accuracy or reliability of the information obtained
and normally renders only the information recovered.
Computer forensic science protocols should be written in a hierarchical manner so that overarching
principles remain constant, but examination techniques can adapt quickly to the computer system to
be examined. This approach to computer forensic protocols may differ from those developed for
many traditional forensic disciplines, but it is necessary to accommodate a unique forensic
examination.
International Principles for Computer Evidence
International Organization on Computer Evidence (IOCE)
The International Organization on Computer Evidence (IOCE) was established in 1995 to provide
international law enforcement agencies a forum for the exchange of information concerning
computer crime investigation and other computer−related forensic issues. Comprised of accredited
government agencies involved in computer forensic investigations, IOCE identifies and discusses
issues of interest to its constituents, facilitates the international dissemination of information, and
develops recommendations for consideration by its member agencies. In addition to formulating
computer evidence standards, IOCE develops communications services between member agencies
and holds conferences geared toward the establishment of working relationships.
140
In response to the G−8 Communique and Action plans of 1997, IOCE was tasked with the
development of international standards for the exchange and recovery of electronic evidence.
Working groups in Canada, Europe, the United Kingdom, and the United States have been formed
to address this standardization of computer evidence.
During the International Hi−Tech Crime and Forensics Conference (IHCFC) of October 1999, the
IOCE held meetings and a workshop which reviewed the United Kingdom Good Practice Guide and
the SWGDE Draft Standards. The working group proposed the following principles, which were
voted upon by the IOCE delegates present with unanimous approval.
IOCE International Principles
The international principles developed by IOCE for the standardized recovery of computer−based
evidence are governed by the following attributes:
• Consistency with all legal systems;
• Allowance for the use of a common language;
• Durability;
• Ability to cross international boundaries;
• Ability to instill confidence in the integrity of evidence;
• Applicability to all forensic evidence; and
• Applicability at every level, including that of individual, agency, and country.
These principles were presented and approved at the International Hi−Tech Crime and Forensics
Conference in October 1999. They are as follow:
• Upon seizing digital evidence, actions taken should not change that evidence.
• When it is necessary for a person to access original digital evidence, that person must be
forensically competent.
• All activity relating to the seizure, access, storage, or transfer of digital evidence must be
fully documented, preserved, and available for review.
• An individual is responsible for all actions taken with respect to digital evidence while the
digital evidence is in their possession.
• Any agency that is responsible for seizing, accessing, storing, or transferring digital evidence
is responsible for compliance with these principles.
Other items recommended by IOCE for further debate and/or facilitation included:
• Forensic competency and the need to generate agreement on international accreditation
and the validation of tools, techniques, and training;
• Issues relating to practices and procedures for the examination of digital evidence; and
• The sharing of information relating to hi−tech crime and forensic computing, such as events,
tools, and techniques.
References
1. American Society of Crime Laboratory Directors/Laboratory Accreditation Board (ASCLD/LAB).
ASCLD/LAB Manual. American Society of Crime Laboratory Directors/Laboratory Accreditation
Board,Garner, NC, 1994, pp. 29–30.
2. CommerceNet Research Council. 2000 Industry Statistics. Available at
141
http://www.commerce.net/research/stats/wwstats.html
3. Fischer, L. M. I.B.M. plans to announce leap in disk−drive capacity, New York Times (December
30, 1997), p. C−2.
4. Noblett, M. G. Report of the Federal Bureau of Investigation on development of forensic tools and
examinations for data recovery from computer evidence. In: Proceedings of the 11th INTERPOL
Forensic Science Symposium, Lyon, France. The Forensic Sciences Foundation Press,Boulder,
CO, 1995.
5. Pollitt, M. The Federal Bureau of Investigation report on computer evidence and forensics. In:
Proceedings of the 12th INTERPOL Forensic Science Symposium, Lyon, France. The Forensic
Sciences Foundation Press,Boulder, CO, 1998.
6. Pollitt, M. Computer Evidence Examinations at the FBI. Unpublished presentation at the 2nd
International Law Enforcement Conference on Computer Evidence, Baltimore, MD, April 10, 1995.
7. ASTM. Form and Style for ASTM Standards. American Society for Testing and
Materials,Philadelphia, PA, 1996.
8. ASTM. Standard Definitions. American Society for Testing and Materials,Scranton, PA, 1994.
9. Osborn, A. S. Questioned Documents. Boyd,Albany, NY, 1929.
10. Hilton, O. Scientific Examination of Questioned Documents. Elsevier,New York, 1982.
11. Harrison, W. R. Suspect Documents. Sweet and Maxwell, London, 1958 and 1966.
12. Conway, J. V. P. Evidential Documents. Charles C Thomas,Springfield, IL, 1959.
13. Ellen, D. The Scientific Examination of Documents Methods and Techniques. Ellis
Horwood,London, 1989.
14. American Society of Crime Laboratory Directors−Laboratory Accreditation Board Manual,
January 1997.
15. ASTM. Form and Style for ASTM Standards. American Society for Testing and
Materials,Philadelphia, PA, 1996.
16. ASTM. Standard Definitions. American Society for Testing and Materials,Scranton, PA, 1994.
17. Osborn, A. S. Questioned Documents. Boyd,Albany, NY, 1929.
18. Hilton, O. Scientific Examination of Questioned Documents. Elsevier,New York, 1982.
19. Harrison, W. R. Suspect Documents. Sweet and Maxwell, London, 1958 and 1966.
20. Conway, J. V. P. Evidential Documents. Charles C Thomas,Springfield, IL, 1959.
21. Ellen, D. The Scientific Examination of Documents Methods and Techniques. Ellis
Horwood,London, 1989.
142
Chapter 9: Computer Crime Policy and Programs
The National Infrastructure Protection Center Advisory 01−003
On March 8, 2001, the National Infrastructure Protection Center (NIPC) issued the NIPC Advisory
01−003, an update to the NIPC Advisory 00−060, "E−Commerce Vulnerabilities," dated December
1, 2000.
This advisory is an update to the NIPC Advisory 00−060, "E−Commerce Vulnerabilities," dated
December 1, 2000. Since the advisory was published, the FBI has continued to observe hacker
activity targeting victims associated with e−commerce or e−finance/banking businesses. In many
cases, the hacker activity had been ongoing for several months before the victim became aware of
the intrusion. The NIPC emphasizes the recommendation that all computer network systems
administrators check relevant systems and consider applying the updated patches as necessary,
especially for systems related to e−commerce or e−banking/ financial businesses. The patches are
available on Microsoft's Web site.
The following vulnerabilities have been previously reported.
Unauthorized Access to IIS Servers through Open Database Connectivity (ODBC) Data
Access with Remote Data Service (RDS)
Systems Affected: Windows NT running IIS with RDS enabled
Details: Microsoft Security Bulletin MS99−025, NIPC CyberNotes 99−22
• http://www.microsoft.com/technet/security/bulletin/ms99−025.asp
• http://www.nipc.gov/warnings/advisories/1999/99−027.htm
• http://www.nipc.gov/cybernotes/cybernotes.htm
Summary: Allows unauthorized users to execute shell commands on the IIS system as a privileged
use; Allows unauthorized access to secured, non−published files on the IIS system; On a
multi−homed Internet−connected IIS systems, using Microsoft Data Access Components (MDAC),
allows unauthorized users to tunnel Structured Query Language (SQL) and other ODBC data
requests through the public connection to a private back−end network.
SQL Query Abuse Vulnerability
Affected Software Versions: Microsoft SQL Server Version 7.0 and Microsoft Data Engine (MSDE)
1.0
Details: Microsoft Security Bulletin MS00−14, NIPC CyberNotes 20−05
• http://www.microsoft.com/technet/security/bulletin/ms00−014.asp
• http://www.nipc.gov/cybernotes/cybernotes.htm
Summary: The vulnerability could allow the remote author of a malicious SQL query to take
unauthorized actions on a SQL Server or MSDE database.
143
Registry Permissions Vulnerability
Systems Affected: Windows NT 4.0 Workstation, Windows NT 4.0 Server
Details: Microsoft Security Bulletin MS00−008, NIPC CyberNotes 20−08 and 20–22
• http://www.microsoft.com/technet/security/bulletin/ms00−008.asp
• http://www.nipc.gov/cybernotes/cybernotes.htm
Summary: Users can modify certain registry keys such that:
• a malicious user could specify code to launch at system crash
• a malicious user could specify code to launch at next login
• an unprivileged user could disable security measures
Web Server File Request Parsing
While they have not been shown to be a vector for the current attacks, Microsoft has advised us that
the vulnerabilities addressed by Microsoft bulletin MS00−086 are very serious, and we encourage
Web site operators to consider applying the patch provided with this bulletin as well as the three that
are under active exploitation.
• http://www.microsoft.com/technet/security/bulletin/ms00−014.asp
• http://www.nipc.gov/cybernotes/cybernotes.htm
Summary: The vulnerability could allow a malicious user to run system commands on a Web server.
New Information: In addition to the above exploits, several filenames have been identified in
connection with the intrusions, specific to Microsoft Windows NT systems. The presence of any of
these files on your system should be reviewed carefully because they may indicate that your system
has been compromised:
• ntalert.exe
• sysloged.exe
• tapi.exe
• 20.exe
• 21.exe
• 25.exe
• 80.exe
• 139.exe
• 1433.exe
• 1520.exe
• 26405.exe
• i.exe
In addition, system administrators may want to check for the unauthorized presence of any of the
following executable files, which are often used as hacking tools:
• lomscan.exe
• mslom.exe
• lsaprivs.exe
• pwdump.exe
• serv.exe
144
• smmsniff.exe
Recipients of this Advisory are encouraged to report computer crime to the NIPC Watch at (202)
323−3204/3205/3206. Incidents may also be reported online at www.nipc.gov/incident/cirr.htm.
NIPC Advisory 01−003 Press Release (March 8, 2001)
Over the past several months, the National Infrastructure Protection Center (NIPC) has been
coordinating investigations into a series of organized hacker activities specifically targeting U.S.
computer systems associated with e−commerce or e−banking. Despite previous advisories, many
computer owners have not patched their systems, allowing these kinds of attacks to continue, and
prompting this updated release of information.
More than 40 victims located in 20 states have been identified and notified in ongoing investigations
in 14 Federal Bureau of Investigation Field Offices and 7 United States Secret Service Field Offices.
These investigations have been closely coordinated with foreign law enforcement authorities, and
the private sector. Specially trained prosecutors in the Computer and Telecommunication
Coordinator program in U.S. Attorneys' Offices in a variety of districts have participated in the
investigation, with the assistance of attorneys in the Computer Crime and Intellectual Property
Section at the Department of Justice.
The investigations have disclosed several organized hacker groups from Eastern Europe,
specifically Russia and the Ukraine, that have penetrated U.S. e−commerce computer systems by
exploiting vulnerabilities in unpatched Microsoft Windows NT operating systems. These
vulnerabilities were originally reported and addressed in Microsoft Security Bulletins MS98−004
(re−released in MS99−025), MS00−014, and MS00−008. As early as 1998, Microsoft discovered
these vulnerabilities and developed and publicized patches to fix them. Computer users can
download these patches from Microsoft for free.
Once the hackers gain access, they download proprietary information, customer databases, and
credit card information. The hackers subsequently contact the victim company through facsimile,
e−mail, or telephone. After notifying the company of the intrusion and theft of information, the
hackers make a veiled extortion threat by offering Internet security services to patch the system
against other hackers. They tell the victim that without their services, they cannot guarantee that
other hackers will not access the network and post the credit card information and details about the
compromise on the Internet. If the victim company is not cooperative in making payments or hiring
the group for their security services, the hackers' correspondence with the victim company has
become more threatening. Investigators also believe that in some instances the credit card
information is being sold to organized crime groups. There has been evidence that the stolen
information is at risk whether or not the victim cooperates with the demands of the intruders. To
date, more than one million credit card numbers have been stolen.
The NIPC has issued an updated Advisory 01−003 at http://www.nipc.gov/ regarding these
vulnerabilities being exploited. The update includes specific file names that may indicate whether a
system has been compromised. If these files are located on your computer system, the NIPC Watch
in Washington, D.C. should be contacted at (202) 323−3204/3205/3206. Incidents may also be
reported online at www.nipc.gov/incident/cirr.htm. For detailed information on the vulnerabilities that
are being exploited, please refer to the NIPC Advisory 00−60, and NIPC Advisory 01−003.
145
The National Information Infrastructure Protection Act of 1996
In October 1996, the National Information Infrastructure Protection Act of 1996 was enacted as part
of Public Law 104–294. It amended the Computer Fraud and Abuse Act, which is codified at 18
U.S.C. § 1030. Below you will find links to the amended version of 18 U.S.C. § 1030, as well as a
legislative analysis, prepared by attorneys from the Computer Crime and Intellectual Property
Section. This legislative analysis was incorporated into the Senate Committee on the Judiciary's
Report on the National Information Infrastructure Protection Act.
Legislative Analysis by the Computer Crime and Intellectual Property Section United States
Department of Justice
Also see Computer Crime and Intellectual Property Section, U.S. Department of Justice, Legislative
Analysis of the 1996 National Information Infrastructure Protection Act, 2 Electronic Info. Pol'y & L.
Rep. 240, 240 (1997).
I. Introduction: The Need for Legislative Reform
Although there has never been accurate nationwide reporting of computer crime, it is clear from the
reports which do exist and from anecdotal information that computer crime is on the rise. For
example, the Computer Emergency and Response Team at Carnegie Mellon University reports that
from 1991 through 1994, there was a 498 percent increase in the number of computer intrusions,
and a 702 percent rise in the number of sites affected. See CERT Annual Report to ARPA. During
1994, for example, approximately 40,000 Internet computers were attacked in 2,460 incidents. Id.
Similarly, the FBI's National Computer Crime Squad has opened over 200 hacker cases since the
Squad was created in 1991.
That computer crime is on the rise is perhaps a natural result of introducing computers into
American society. In an earlier era, the advent of the automobile opened the way for criminals to
target the automobile itself (e.g., auto theft) or use it to facilitate traditional crimes (e.g., the bank
robbery getaway vehicle). In addition, law enforcement had to learn to seize vehicles to search them
for evidence of some offense unrelated to the vehicle itself (e.g., the box of documents in the trunk).
In many of the same ways, computers, too, have proven important to criminal investigations. First, a
computer may be the target of the offense. In these cases, the criminal's goal is to steal information
from, or cause damage to, a computer, computer system, or computer network. Second, the
computer may be a tool of the offense. This occurs when an individual uses a computer to facilitate
some traditional offense such as fraud (e.g., a bank teller who once stole money from a cash drawer
may now use a computer program to skim money directly from depositors' accounts). Last,
computers are sometimes incidental to the offense, but significant to law enforcement because they
contain evidence of a crime. Narcotics dealers, for example, may use a personal computer to store
records pertaining to drug trafficking instead of relying on old−fashioned ledgers.
The different ways in which criminals can use computers have created a philosophical debate
among law enforcement experts. Some argue that computer crime is nothing more than traditional
crime committed with new, high−tech devices. Others contend that computer crime cannot be
analogized to traditional crime and that combatting it requires both innovative law enforcement
techniques and new laws designed to address abuses of emerging technologies. In 1984, Congress
adopted the latter view and enacted discrete legislation to address crime in electronic environments.
Although certain computer crimes appear simply to be old crimes committed in new ways (e.g., the
bank teller who uses a computer program to steal money is still committing bank fraud), some
computer offenses find their genesis in our new technologies and must be specifically addressed by
statute. For example, the widespread damage caused by inserting a virus into a global computer
146
network cannot be prosecuted adequately by relying upon common law criminal mischief statutes.
Indeed, it is questionable whether Robert Morris, the individual responsible for launching the Morris
worm and crippling 6,000 computers around the world, could have been prosecuted had Congress
not had the foresight to enact the Computer Fraud and Abuse Act.
Whether classified as "old" or "new," computer crime creates unique problems for law enforcement
and a concomitant threat to the public welfare. The most significant legislative problems stem from
technology's shift from a corporeal to an intangible environment. This departure from a physical
world (where items are stored in a tangible form that can be carried, such as information written on
paper) to an intangible, electronic environment means that computer crimes (and the methods used
to investigate them) are no longer subject to traditional rules and constraints. Consider, for example,
the way the crimes of theft and criminal mischief have evolved. Before the advent of computer
networks, the ability to steal information or damage property was to some extent determined by
physical limitations. A burglar could break only so many windows and burglarize only so many
homes in a week. During each intrusion, the burglar could carry away only so many items. This
does not, of course, make this conduct trivial, but it points out that the amount of property a burglar
could steal, or the amount of damage he could cause, had physical limits.
In the information age, of course, these limitations no longer apply. A criminal seeking information
stored in a networked computer with dial−in access can acquire that information from virtually
anywhere in the world. The quantity of information stolen or the amount of damage caused by
malicious programming code may be limited only by the speed of the network and the criminal's
computer equipment. Moreover, such conduct can easily occur across state and national borders.
This clear shift to a borderless, incorporeal environment and the increased risk that information will
be stolen and transported in electronic form is difficult to address by relying upon older laws written
to protect physical property. For example, the statute pertaining to interstate transportation of stolen
property, 18 U.S.C. § 2314, speaks of "goods, wares and merchandise," and consequently has
been held by at least one court not to apply to intangible property. See United States v. Brown, 925
F.2d 1301, 1308 (10th Cir. 1991). Similarly, the long−familiar extortion statute makes it illegal, in
some cases, to threaten physical violence to property. 18 U.S.C. § 1951(a). Although a threat to fire
bomb a building would clearly satisfy this test, a threat to delete files may not.
II. The Structure of Title 18 Reform
There are two ways, conceptually, to address the growing computer crime problem. The first would
be to comb through the entire United States Code, identifying and amending every statute
potentially affected by the implementation of new computer and telecommunications technologies.
The second would be to focus substantive amendments on the Computer Fraud and Abuse Act to
specifically address new abuses that spring from the misuse of new technologies.
The new legislation adopts the latter approach for a host of reasons:
1. The United States, in a single statute, continues to address the core issues driving computer
and information security at both domestic and international levels; that is, protecting the
confidentiality, integrity, and availability of data and systems. Indeed, these three themes
provide the foundation for the Organization for Economic Cooperation and Development's
(OECD) Guidelines for the Security of Information Systems. They also serve as the linchpin
for emerging domestic works on information privacy. See, e.g., Draft Principles for Providing
and Using Personal Information, 60 Fed. Reg. 4362 (January 20, 1995) [hereinafter "Draft
Principles"]. By patterning the amended Computer Fraud and Abuse Act on the OECD
guidelines, the U.S. is at the forefront of rethinking how information technology crimes must
147
be addressed — simultaneously protecting the confidentiality, integrity, and availability of
data and systems. And by choosing this path, we may encourage other countries to adopt a
similar framework, thus creating a more uniform approach to addressing computer crime in
the existing global information infrastructure.
2. In most cases, a single point of reference — The Computer Fraud and Abuse Act, 18 U.S.C.
§ 1030 — is provided for investigators, prosecutors, and legislators as they attempt to
determine whether a particular abuse of new technology is covered under federal criminal
law.
3. As new technologies are introduced and the criminal law requires reconsideration,
fine−tuning § 1030 may well be adequate, and it will not be necessary to continually parse
through the entire United States Code.
4. This statutory scheme will give us a better understanding of the scope of the computer crime
problem by enabling more reliable statistics to be generated regarding computer abuse.
Under current law, computer crimes can be charged under a host of criminal statutes, and
this situation will continue if the U.S. chooses a patchwork approach and amends the
various provisions of Title 18 to address new computer crimes. The existence of various
computer crime provisions in different parts of Title 18 exacerbates an already obvious
problem; i.e., computer crime experts have long admitted that there are no centralized
computer crime statistics, not even within the law enforcement community. Indeed, a June
1996 study by the United States Sentencing Commission concluded that there were only
174 cases in which the statute of conviction included 18 U.S.C. § 1030, but conceded that
…pertinent questions remain unanswered. For example, how much criminal
behavior that could have been successfully prosecuted under 18 U.S.C. §
1030 was prosecuted under other fraud statutes… ?
— United States Sentencing Commission,
Report to Congress: Adequacy of Federal Sentencing Guideline Penalties for
Computer Fraud and Vandalism Offenses, pp. 2, 6
By centralizing computer crimes under one statute, we may better measure existing harms,
anticipate trends, and determine the need for further legislative reform. Additionally,
amendments to the sentencing scheme of 18 U.S.C. § 1030 (and the Federal Sentencing
Guidelines — 2F1.1 — upon which actual sentences are based), will be more effectively
determined.
5. Last, 18 U.S.C. § 1030(f) specifically provides that certain government officials, if engaging
in lawfully authorized investigative, protective, or intelligence activities, are not restricted by
§ 1030. By amending only 18 U.S.C. § 1030 to address new high−tech offenses, this
exception clearly continues to apply to any newly defined criminal conduct.
III. Specific Amendments: Protecting the Confidentiality, Integrity, and Availability of
Systems and Information
A. Section 1030(a)(1)
Title 18, Section 1030(a)(1) originally provided that anyone who knowingly accesses a computer
without authorization or exceeds authorized access and obtains classified information "with the
intent or reason to believe that such information so obtained is to be used to the injury of the United
States, or to the advantage of any foreign nation" is subject to a fine or imprisonment for not more
that ten years (for a first offense). 18 U.S.C. § 1030(a)(1) (emphasis added). This scienter element
apparently was included when this subsection was originally drafted because it is contained in 18
U.S.C. § 794(a). Section 794(a), however, provides for life imprisonment, whereas § 1030(a)(1) is
only a ten−year felony. Therefore, it is more appropriate that the language of § 1030(a)(1) should
148
track the language of 18 U.S.C. § 793(e), which also provides a maximum penalty of ten years'
imprisonment for obtaining from any source certain information connected with the national defense
and thereafter communicating or attempting to communicate it in an unauthorized manner.
It should be noted that, although there is considerable overlap between § 793(e) and § 1030(a)(1)
as amended, the two statutes do not reach exactly the same conduct. Section 1030(a)(1) would
require proof that the individual knowingly used a computer without authority, or in excess of
authority, for the purpose of obtaining classified information or restricted data, and subsequently
performed some unauthorized communication or other improper act. In this sense then, it is the use
of the computer which is being proscribed, not the unauthorized possession of, control over, or
subsequent transmission of the information itself. Existing espionage laws would provide an
adequate basis for the prosecution of individuals who attempt to peddle governmental secrets to
foreign governments. However, a person who deliberately breaks in to a computer for the purpose
of obtaining properly classified or restricted information, or attempts to do so, should be subject to
criminal prosecution for this conduct.
B. Section 1030(a)(2)
Subsection (a)(2) is, in the truest sense, a provision designed to protect the confidentiality of
computer data. As was noted in 1986 by the Senate Judiciary Committee,
[t]he premise of 18 U.S.C. 1030(a)(2) will remain the protection, for privacy reasons,
of computerized credit records and computerized information relating to customers'
relationships with financial institutions… . Because the premise of this subsection is
privacy protection, the Committee wishes to make clear that 'obtaining information' in
this context includes mere observation of the data.
— S. Rep. No. 99–432 at 6.
With the continued evolution of the National Information Infrastructure (NII), however, Congress has
come to recognize that not only financial records and credit information warrant federal protection.
As noted in the commentary to the Draft Principles, "with the NII, the assumption is that large
amounts of sensitive information will be online, and can be accessed, perhaps without authority, by
a large number of network users." 59 Fed. Reg. at 27207. Moreover, "the NII will only achieve its full
potential if individual privacy is properly protected." Id. Therefore, the new subsection 1030(a)(2) is
designed to insure that it is punishable to misuse computers to obtain government information and,
where appropriate, information held by the private sector. Moreover, the provision has been
restructured so that different paragraphs protect different types of information, thus allowing easy
additions or modifications to offenses if events require.
Certainly not all computer misuse warrants federal criminal sanctions. The problem is that no litmus
test can accurately segregate important from unimportant information, and any legislation may
therefore be under− or over−inclusive. For example, a frequent test for determining the
appropriateness of federal jurisdiction — a monetary amount — does not work well when protecting
information. The theft from a computer of a judge's draft opinion in a sensitive case or the copying of
medical records might not meet such a monetary threshold, but clearly such information should be
protected. Therefore, the act of taking all of this kind of information is now criminalized. Even so, it is
important to remember that the elements of the offense include not just taking the information, but
abusing one's computer authorization to do so.
The need to protect information is highlighted by recent studies indicating that people are
increasingly misusing computers to obtain information. In 1993, the General Accounting Office
(GAO) presented testimony before the House Government Operations Committee, Subcommittee
149
on Information, Justice, Agriculture, and Transportation, on the abuse of National Crime Information
Center (NCIC) information. The testimony stated that, following an investigation, GAO determined
that (1) NCIC information is valuable, (2) such information has been misused by "insiders"
(individuals with authorized access), (3) this misuse included selling NCIC information to outsiders
and determining whether friends and relatives had criminal records, and (4) incentives for misuse
outweighed potential penalties. Statement of Laurie E. Ekstrand, July 28, 1993, p. 6 [hereinafter
"Ekstrand Statement"]. The GAO found that some of this misuse jeopardized the safety of citizens
and potentially jeopardized law enforcement personnel. Id. at 16. Moreover, because there were no
federal or state laws specifically directed at NCIC misuse, most abusers of NCIC were not criminally
prosecuted. Id. at 17. GAO concluded that Congress should enact legislation with strong criminal
sanctions specifically directed at the misuse of NCIC. Id. at 20.
Of course, protecting only NCIC data (or, more broadly, criminal history information), would be
underinclusive, because other types of sensitive data are clearly at risk. For example, during
Operation Desert Storm, it was widely reported that hackers accessed sensitive but unclassified
data regarding personnel performance reports, weapons development information, and logistics
information regarding the movement of equipment and personnel. Teen tapped computers of U.S.
military, Chicago Tribune, November 21, 1991 at 3. NASA computers have also been penetrated,
Computer Hacker Charged with Entering NASA System, Washington Post, September 26, 1991 at
A20, as have at least two federal courthouse computer systems. See, e.g., U.S. Says Hackers
Scanned Data, The New York Times, November 15, 1992, at A40. Some Internal Revenue Service
employees also improperly used IRS computers to examine tax return information. I.R.S. Staff Is
Cited in Snoopings, The New York Times, July 19, 1994, at D1, D5.
Clearly, the government should be able to prosecute individuals who obtain government information
by misusing computers. Importantly, 18 U.S.C. § 1030(a)(2), as amended, does not punish the
mere acquisition of information (which might unduly impede the free flow of ideas), but prohibits
intentionally accessing a computer without or in excess of authority and then obtaining such
information. Moreover, to the extent that the information obtained is or should be available, it should
be obtained through legal means (e.g., public sources or FOIA) and not through hacking.
Subsection 1030(a)(2)(C) is designed to protect against the interstate or foreign theft of information
by computer. Such a provision is necessary in light of the Tenth Circuit's decision in United States v.
Brown, 925 F.2d 1301, 1308 (10th Cir. 1991), where the court held that purely intangible intellectual
property, such as a computer program, cannot constitute goods, wares, merchandise, securities, or
moneys which have been stolen, converted, or taken within the meaning of § 2314. "Information" as
used in this subsection is meant to be broadly construed and includes information stored in
intangible form. Moreover, consistent with Congress's prior construction of § 1030(a)(2), "obtaining
information" includes merely reading it; i.e., there is no requirement that the information be copied or
transported. This is critically important because, in an electronic environment, information can be
"stolen" without asportation, and the original usually remains intact.
Some computers may qualify under more than one subsection of § 1030(a)(2); for example, a
particular government computer might be covered by both § 1030(a)(2)(B) and (a)(2)(C). This
overlap serves to eliminate legal issues that might have arisen had Congress made the provisions
mutually exclusive. Conceivably, in a given case, it may not be clear whether information taken from
a government contractor's computer constitutes "information from any department or agency of the
United States" under § 1030(a)(2)(B), but the offense might still be chargeable under §
1030(a)(2)(C) if the elements of that subsection are satisfied.
The seriousness of a breach in confidentiality depends, in considerable part, on either the value of
the information or the defendant's motive in taking it. Thus, the statutory penalties are structured so
150
that merely obtaining information of minimal value is only a misdemeanor, but certain aggravating
factors make the crime a felony. More specifically, the crime becomes a felony if the offense was
committed for purposes of commercial advantage or private financial gain, for the purpose of
committing any criminal or tortious act in violation of the Constitution or laws of the United States or
of any State, or if the value of the information obtained exceeds $5,000.
As for enhancements not based on the value of the property obtained, recent documented cases
indicate that individuals misuse information for a variety of unacceptable purposes. The terms "for
purposes of commercial advantage or private financial gain" and "for the purpose of committing any
criminal or tortious act" are taken from the copyright statute (17 U.S.C. § 506(a)) and wiretap statute
(18 U.S.C. § 2511(1)(d)), respectively.
As for the monetary threshold, any reasonable method can be used to establish the value of the
information obtained. For example, the research, development, and manufacturing costs, or the
value of the property "in the thieves' market," can be used to meet the $5,000 valuation. See, e.g.,
United States v. Stegora, 849 F.2d 291, 292 (8th Cir. 1988).
The relationship between the existing § 1030(a)(3) provision and the newly amended § 1030(a)(2)
merits some discussion. Section 1030(a)(3) protects the computer from outsiders, even if the hacker
obtains no information. Thus, an intruder who violates the integrity of a government machine to gain
network access is nonetheless liable for trespass even when he has not jeopardized the
confidentiality of data. Section 1030(a)(2), on the other hand, protects the confidentiality of data,
even from intentional misuse by insiders. Additionally, although a first violation of § 1030(a)(3) is
always a misdemeanor, a § 1030(a)(2) violation may constitute a felony if the information taken is
valuable or sufficiently misused. See § 1030(c)(2)(B)(raising the offense to felony level based on the
value or intended use of the improperly acquired data). Although a single act may violate both
provisions, the provisions protect against different harms and, in any event, the actor's conduct
would be aggregated for the purposes of sentencing.
C. Subsection 1030(a)(3)
Three substantive changes were made to § 1030(a)(3). First, the word "adversely" has been deleted
because including this term suggests, inappropriately, that trespassing in a government computer
may be benign.
Second, for clarity, the term "the use of the Government's operation of such computer" has been
replaced with the term "that use by or for the Government of the United States." When a computer
is used for the government, the government is not necessarily the operator, and the old term may
have led to confusion. Consistent with this change, a similar change was made to the definition of
"federal interest computer" (redesignated as "protected computer") in § 1030(e)(2)(A). Third,
Congress inserted "non−public" to modify "computer of a department or agency of the United
States." This change is intended to reflect the growing use of the Internet by government agencies
and, in particular, the establishment of World Wide Web home pages and other public services.
Arguably, a person charged under the old subsection (a)(3) might have asserted as a defense that
he was not "without authorization to access any computer of a department or agency of the United
States," because he was authorized to access some publicly available computer of that department
or agency, such as a Web site. While this defense would almost have negated the law and thus
defied a common−sense interpretation of the former law, Congress added the word "non−public" to
make it perfectly clear that a person who has no authority to access any non−public computer of a
department or agency may be convicted under (a)(3) even though permitted to access publicly
available computers.
151
D. Subsection 1030(a)(4)
Subsection 1030(a)(4) has been amended to insure that felony level sanctions apply when
unauthorized use of the computer (or use exceeding authorization) is significant. At the time the
"computer use" exception was originally crafted, the Senate Judiciary Committee noted that:
[T]he mere use of a computer or computer service has a value all its own. Mere
trespasses onto someone else's computer system can cost the system provider a
"port" or access channel that he might otherwise be making available for a fee to an
authorized user. At the same time, the Committee believes it is important to
distinguish clearly between acts of fraud under (a)(4), punishable as felonies, and
acts of simple trespass, punishable in the first instance as misdemeanors. That
distinction would be wiped out were the Committee to treat every trespass as an
attempt to defraud a service provider of computer time.
— S. Rep. No. 99–432, 99th Cong., 2d Sess. 10 (1986).
See also H.R. Rep. No. 99−612, 99th Cong., 2d Sess. 12 (1986).
Although Congress retains the concern about converting every trespass into a felony scheme to
defraud, this new amendment clearly recognizes that a blanket exception for computer use may be
too broad. Hackers, for example, have broken into Cray supercomputers for the purpose of running
password cracking programs, sometimes amassing computer time worth far in excess of $5,000. In
light of the large expense to the victim caused by some of these trespassing incidents, it is more
appropriate to except from the felony provisions of subsection 1030(a)(4) only cases involving no
more than $5,000 of computer use during any one−year period.
E. Subsection 1030(a)(5)
Subsection 1030(a)(5) was completely restructured in 1994, but the 1994 law may have had some
unintended consequences. Most notably, certain government and financial institution computers
may have been denied previously existing federal protection; some hacking activities may have
been inappropriately decriminalized; and certain insider conduct may have been inappropriately
criminalized.
In the 1994 amendments, the reach of this subsection was broadened by replacing the term "federal
interest computer" with the term "computer used in interstate commerce or communications." The
latter term is broader because the old definition of "federal interest computer" in 18 U.S.C. §
1030(e)(2)(B) covered a computer "which is one of two or more computers used in committing the
offense, not all of which are located in the same State." This meant that a hacker who attacked
other computers in the same state was not subject to federal jurisdiction, even when these actions
may have severely affected interstate or foreign commerce. For example, individuals who attack
telephone switches may disrupt interstate and foreign calls. The 1994 change remedied that defect.
However, the definition of federal interest computer actually covered more than simply interstate
activity. More specifically, 18 U.S.C. § 1030(e)(2)(A) covered, generically, computers belonging to
the United States Government or financial institutions, or those used by such entities on a
non−exclusive basis if the conduct constituting the offense affected the Government's operation or
the financial institution's operation of such computer. By changing § 1030(a)(5) from "federal
interest computer" to "computer used in interstate commerce or communications," Congress may
have inadvertently eliminated federal protection for those government and financial institution
computers not used in interstate communications. For example, the integrity and availability of
classified information contained in an intrastate local area network may not have been protected
under the 1994 version of 18 U.S.C. § 1030(a)(5), although its confidentiality continued to be
152
protected under 18 U.S.C. § 1030(a)(1). To remedy this situation in the 1996 Act, 18 U.S.C. §
1030(a)(5) was redrafted to cover any "protected computer," a new term defined in § 1030(e)(2) and
used throughout the new statute — in § 1030(a)(5), as well as in §§ 1030(a)(2), (a)(4), and the new
(a)(7). The definition of "protected computer" includes government computers, financial institution
computers, and any computer "which is used in interstate or foreign commerce or communications."
This broad definition addresses the original concerns regarding intrastate "phone phreakers" (i.e.,
hackers who penetrate telecommunications computers). It also specifically includes those
computers used in "foreign" communications. With the continually expanding global information
infrastructure, with numerous instances of international hacking, and with the growing possibility of
increased global industrial espionage, it is important that the United States have jurisdiction over
international computer crime cases. Arguably, the old definition of "federal interest computer"
contained in 18 U.S.C. § 1030(e)(2) conferred such jurisdiction because the requirement that the
computers used in committing the offense not all be located in the same state might be satisfied if
one computer were located overseas. As a general rule, however, Congress's laws have been
presumed to be domestic in scope only, absent a specific grant of extraterritorial jurisdiction.
E.E.O.C. v. Arabian American Oil Co., 499 U.S. 244 (1991). To ensure clarity, the statute was
amended to reference international communications explicitly.
Another concern with the 1994 version of 18 U.S.C. § 1030(a)(5) involved the overall statutory
scheme. Under the 1986 version of subsection 1030(a)(5), the actor causing the harm must have
been without authority to access the victim computer. As such, the provision never applied to
insiders, although insiders are often responsible for intentionally causing computer damage. Indeed,
the Justice Department was forced to decline prosecution in some cases where individuals
intentionally inserted malicious programming code into computers, because those individuals were
authorized to access the attacked system. The 1994 law, in contrast to the 1986 version,
appropriately applied to both insiders and those without authorized access who intentionally caused
damage.
Unfortunately, however, by eliminating the trespassing requirement, and at the same time requiring
the government to prove that the actor either intentionally or recklessly caused damage, the 1994
law no longer punished a person who broke into a federal interest computer and "thereby caused
loss." See 18 U.S.C. § 1030(a)(5) [1986 version]. Thus, the enactment of the 1994 legislation
decriminalized some hacking and inadvertently sent the message that breaking into computers was
acceptable so long as the actor neither intended nor recklessly caused damage. However, in these
1996 amendments, criminal liability for such behavior has been restored. This was clearly
necessary in light of the increased importance of computer networks in today's society and the
nation's considerable interest in creating a trusted national information infrastructure that insures the
confidentiality, integrity, and availability of information and systems.
This problem, now corrected, arose because the 1986 and 1994 versions of Section 1030(a)(5)
defined improper conduct in completely different ways — the former by focusing only on the actor's
authority to access the computer; the latter by considering solely the actor's intent. Of course, these
two separate litmus tests each cover important aspects of criminal computer damage, but neither
measure, taken alone, fully succeeds in describing the acts which should be criminal. For example,
although those who intentionally damage a system should be punished regardless of whether they
are authorized users, it is equally clear that anyone who knowingly invades a system without
authority and causes significant loss to the victim should be punished as well, even when the
damage caused is not intentional. In such cases, it is the intentional act of trespass that makes the
conduct criminal. To provide otherwise is to openly invite hackers to break into computer systems,
safe in the knowledge that no matter how much damage they cause, they commit no crime unless
that damage was either intentional or reckless. Rather then send such a dangerous message (and
153
deny victims any relief), it is better to insure that § 1030(a)(5) criminalizes all computer damage
done by outsiders, as well as intentional damage by insiders, albeit at different levels of severity.
By using a matrix, [Exhibits 1 and 2 show] that neither the 1986 law nor the 1994 law was adequate,
although they fail in different categories.
Exhibit 1: § 1030(a)(5) [1986 Version] [Based on the defendant's authority to access the computer]
Trespassers
Intentional Damage Felony
Reckless Damage Felony
Negligent Damage Felony
Authorized Users
No crime
No crime
No crime
Exhibit 2: 18 U.S.C. § 1030(a)(5)[1994 Version] [Based on the defendant's criminal intent to
damage]
Trespassers Authorized Users
Intentional Damage Felony
Felony
Reckless Damage Misdemeanor Misdemeanor
Negligent Damage No crime
No crime
Conceptually, a comprehensive statutory scheme does not treat these two tests — mental state and
authority to access — as mutually exclusive. Instead, it integrates them to cover all kinds of serious
misconduct. Just as important, it recognizes that some behaviors are less serious, or should not be
criminal offenses at all. For example, the 1994 law created a misdemeanor for reckless damage
without distinguishing between trespassers and authorized users. Whether authorized users should
ever be criminally liable for reckless damage is a debatable question. For example, it could be
deemed reckless in today's computer environment to intentionally copy a file from a floppy diskette
to a hard drive without first running a virus scan — although imposing criminal sanctions for such
conduct is clearly inappropriate, absent other evidence of criminal intent. On the other hand,
reckless trespassers warrant felony prosecutions, since they are unauthorized users who pose
significant risks to computer systems. Thus, Congress has now chosen an approach that integrates
access and authority tests, as shown in Exhibit 3.
Exhibit 3: 18 U.S.C. § 1030(a)(5) [The New Law] [Based on the defendant's authority to access the
computer and criminal intent to damage]
Trespassers
Intentional Damage Felony
Reckless Damage Felony
Negligent Damage Misdemeanor
Authorized Users
Felony
No crime
No crime
Essentially, this new statute provides that individuals who access protected computers without
authority are responsible for the consequences of their actions, but those accessing with authority
are criminally liable only if they intend to cause damage to the victim.
Although subsections § 1030(a)(5)(B) and (a)(5)(C) require that the actor cause damage as a result
of his or her unauthorized access, damages are not limited to those caused by the process of
gaining illegal entry. Rather, all damage, whether caused while gaining access or after entry, is
relevant.
154
Another concern with the 1994 law was that it required both "damage" and "loss," without clearly
articulating what constituted "damage." For example, intruders often alter existing log−on programs
so that user passwords are copied to a file which the hackers can retrieve later. After retrieving the
newly created password file, the intruder restores the altered log−on file to its original condition.
Arguably, in such a situation, neither the computer nor its information has been damaged.
Nonetheless, the intruder's conduct allowed him to accumulate valid user passwords to the system,
required all system users to change their passwords, and required the system administrator to
devote resources to re−securing the system. Thus, although there may be no permanent "damage,"
the victim does suffer "loss." If the loss to the victim meets the required monetary threshold, the
conduct should be criminal, and the victim should be entitled to relief.
It would not have been possible to address all of these concerns by making only minor amendments
to subsection 1030(a)(5). Thus, the statutory scheme was altered to both simplify its provisions and
adopt the sanctions provided in Exhibit 3.
As discussed further below, the term "damage" remains, but is now defined in 18 U.S.C. §
1030(e)(8). Consistent with the view that § 1030(a)(5) protects the integrity and availability of data
and systems, "damage" means any impairment of those attributes. The statutory language avoids
listing specific acts that can cause such impairment to insure that its coverage is suitably broad. For
example, in the 1986 version, the terms "alters, damages or destroys information," were included,
inadvertently raising new issues (e.g., whether encrypting data satisfies this test since the
underlying original information remains unchanged). Rather than providing a list of prohibited
actions and risk being underinclusive, the statute focuses instead on the harms it seeks to prevent.
This harm−based definition of "damage" can now be found in subsections 1030(e)(8)(A) through
(D). As in the past, the term "damage" will require meeting one of several significant thresholds.
Two of these measures survive from earlier versions of § 1030: the first is significant financial losses
— although raised in these amendments from $1000 to $5000 — [§ 1030(e)(8)(A)]; the second is
potential impact on medical treatment [§ 1030(e)(8)(B)]. In addition, Congress has listed two new
threshold harms in its definition of "damage": causing physical injury to any person [18 U.S.C. §
1030(e)(8)(c)] and threatening the public health or safety [18 U.S.C. § 1030(e)(8)(c)]. As the NII and
other network infrastructures continue to grow, computers will increasingly be used for access to
critical services such as emergency response systems and air traffic control, and will be critical to
other systems that we cannot yet anticipate. Thus, any definition of "damage" must broadly
encompass the types of harms against which people should be protected.
Having amended the structure of § 1030(a)(5), Congress needed to amend the civil penalty
provision under § 1030(g). The subsection as amended provides that victims of computer abuse
can maintain a civil action against the violator to obtain compensatory damages, injunctive relief, or
other equitable relief, but damages are limited to economic damages for cases where the only
damage suffered by the plaintiff is monetary loss as defined by § 1030(e)(8)(A).
F. Subsection 1030(a)(7)
New subsection (a)(7) is designed to respond to a growing problem: the interstate transmission of
threats directed against computers and computer networks. Such threats, if accompanied by an
intent to extort, may already be covered in some instances by the Hobbs Act, 18 U.S.C. § 1951,
which applies to interference with commerce by extortion. They also may be covered in some
instances by 18 U.S.C. § 875(d), which applies to interstate communication of a threat to injure the
property of another. However, under both of these statutes, it is not absolutely clear that "property"
includes the unimpaired operation of a computer or the unrestricted access to the data or programs
stored in a computer and its peripheral equipment. Moreover, it is not clear that certain actions
(such as encrypting someone's data and then demanding money for the key) constitute a threat to
155
"injure the property of…another." See 18 U.S.C. § 875(d).
These concerns are not theoretical. In one recent case, for example, an individual threatened to
crash a computer system unless he was granted access to the system and given an account.
Another case involved an individual who penetrated a city government's computer system and
encrypted the data on a hard drive, thus leading the victim to suspect an extortion demand was
imminent. (This demand never came, however, and fortunately the victim was able to recover from
the incident.) Although the number of such incidents is currently small, the explosion in network
access has substantially increased the risk that such conduct will occur, and our nation's increased
reliance on computers clearly suggests that such activities, if not deterred, will severely impair our
ability to use the NII effectively. Moreover, since such extortion and threats will normally involve
interstate and foreign communications, federal law enforcement needed a clear basis to address
this new problem quickly.
It is worth noting that subsection (a)(7) covers any interstate or international transmission of threats
against computers, computer networks, and their data and programs, whether the threat is received
by mail, a telephone call, electronic mail, or through a computerized message service. The provision
is worded broadly to cover threats to interfere in any way with the normal operation of the computer
or system in question, such as denying access to authorized users, erasing or corrupting data or
programs, or slowing down the operation of the computer or system. The extortion element is
modeled after that in 18 U.S.C. §§ 875(b) and (d).
G. Sentencing Provisions: Subsection 1030(c)
The sentencing provisions of § 1030 have been altered to reflect the new statutory scheme and to
address an old, technical error. As previously enacted, recidivists were only subject to enhanced
penalties if they violated the same subsection twice. For example, if an individual violated the Act by
committing fraud by computer [subsection (a)(4)] and later committed another computer crime
offense by intentionally destroying medical records [subsection (a)(5)], he was not a recidivist
because his conduct violated two separate subsections of § 1030. Congress has changed the
statutory language to provide that anyone who is convicted twice of committing a computer offense
will be subjected to enhanced penalties.
H. Jurisdiction: Subsection 1030(d)
Having created several new crimes in 18 U.S.C. § 1030, Congress needed to consider the
jurisdictional grant in 18 U.S.C. § 1030(d). For some time, the Federal Bureau of Investigation and
the United States Secret Service have shared concurrent jurisdiction over § 1030 based on a
Memorandum of Understanding. This new Act, by creating certain new crimes, does not alter any
existing agreements, nor limit or alter an agency's "traditional" jurisdiction. Thus, there is new
language in 18 U.S.C. § 1030(d) to insure that the status quo is maintained. For example, the new
18 U.S.C. § 1030(a)(2)(C) addressed gaps in 18 U.S.C. § 2314 (interstate transportation of stolen
property), and the new 18 U.S.C. § 1030(a)(7) addressed gaps in 18 U.S.C. § 1951 (the Hobbs Act)
and 18 U.S.C. § 875 (interstate communications). All of these statutes are within the traditional
jurisdiction of the FBI, therefore 18 U.S.C. § 1030(d) did not extend to the United States Secret
Service concurrent jurisdiction over these types of offenses, even when committed by computer.
Subsections over which the Secret Service maintains concurrent jurisdiction are § 1030(a)(2)(A)
and (B), (a)(3), (a)(4), (a)(5), and (a)(6).
156
Distributed Denial of Service Attacks
In the week of February 7, 2000, hackers launched distributed denial of service (DDS) attacks on
several prominent Web sites, including Yahoo!, E*Trade, Amazon.com, and eBay. In a DDS attack,
dozens or even hundreds of computers all linked to the Internet are instructed by a rogue program
to bombard the target site with nonsense data. This bombardment soon causes the target sites's
servers to run out of memory, and thus cause it to be unresponsive to the queries of legitimate
customers. On February 29, 2000, Deputy Attorney General Eric Holder and Director of the National
Infrastructure Protection Center Michael A. Vatis testified before a House and Senate Joint Judiciary
Subcommittee meeting to talk about the distributed denial of services attacks and about cybercrime
in general.
Internet Denial of Service Attacks and the Federal Response
Eric Holder, Deputy Attorney General of the United States Subcommittee on Crime of the House
Committee on the Judiciary and the Subcommittee on Criminal Oversight of the Senate Committee
on the Judiciary Mr. Chairmen and other Members of the Subcommittees, I want to thank you for
this opportunity to testify on the recent Internet "denial of service" attacks and the federal response
to these incidents, with a particular focus on the challenges facing the Department of Justice in its
fight against cybercrime. Both Subcommittees have been very helpful in providing the Department
with the resources and tools we need to keep pace with the ever−changing demands of law
enforcement and public safety, particularly the new challenge of cybercrime. At a time where new
technologies abound and our society becomes increasingly reliant on computer networks and thus
vulnerable to cybercrime, we look forward to working again with you to ensure that law enforcement,
in cooperation with the private sector, can play an appropriate and critical role in protecting the
well−being of Americans.
Comments on the Recent Attacks
I would be happy to address your questions on the recent attacks, to the extent I can do so without
compromising our investigation. At this point, I would simply say that we are taking the attacks very
seriously and that we will do everything in our power to identify those responsible and bring them to
justice. In addition to the malicious disruption of legitimate commerce, so−called "denial of service"
attacks involve the unlawful intrusion into an unknown number of computers, which are in turn used
to launch attacks on the eventual target computer, in this case the computers of Yahoo, eBay, and
others. Thus, the number of victims in these types of cases can be substantial, and the collective
loss and cost to respond to these attacks can run into the tens of millions of dollars — or more.
Overview of Investigative Efforts and Coordination
Computer crime investigators in a number of FBI field offices and investigators from other agencies
are investigating these attacks. They are coordinating information with the National Infrastructure
Protection Center (NIPC) of the FBI. The agents are also working closely with our network of
specially trained computer crime prosecutors who are available 24 hours a day/7 days a week to
provide legal advice and obtain whatever court orders are necessary. Attorneys from the Criminal
Division's Computer Crime and Intellectual Property Section (CCIPS) are coordinating with the
Assistant United States Attorneys in the field. We are also obtaining information from victim
companies and security experts, who, like many in the Internet community, condemn these recent
attacks. We are also working closely with our counterparts in other nations. I am proud of the efforts
being made in this case, including the assistance we are receiving from a number of federal
agencies.
157
The Emergence of Cybercrime
It is worth remembering that just ten years ago, the Internet was largely unknown and unavailable to
the average person. There was no e−commerce, no e−Bay, no amazon−dot−com, very little
dot−anything. At that time, the Internet was a collection of military, academic, and research
networks serving a small community of trusted users. Many of us were just learning about pagers
and cell phones, VCRs, and videocams.
That world is history. The far−reaching, ever−expanding, and ever more rapid advances in
computer and software technology over the last ten years have combined with the explosive growth
of the Internet to change the world forever. For the most part, the Internet and other technologies
are providing wonderful benefits to our society — from providing new, high−wage jobs to our
economy, to expanding educational opportunities, to improving health care, and in countless other
ways.
Unfortunately, these wonderful technologies also provide new opportunities for criminals. Online
crime is rapidly increasing. We are seeing more "pure" computer crimes, that is, crimes where the
computer is used as a weapon to attack other computers, as we saw in the distributed denial of
service attacks I just spoke about, and in the spread of malicious code, like viruses. Our
vulnerability to this type of crime is astonishingly high — it was only this past December that a
defendant admitted, when he pled guilty in federal and state court to creating and releasing the
Melissa virus, that he caused over 80 million dollars in damage. These crimes also include
computer intrusions designed to obtain information of the most sensitive sort — such as credit
cards, companies' trade secrets, or individual's' private information.
These crimes not only affect our financial well−being and our privacy; they also threaten our nation's
critical infrastructure. Our banking system, the stock market, the electricity and water supply,
telecommunications networks, and critical government services, such as emergency and national
defense services, all rely on computer networks. For a real−world terrorist to blow up a dam, he
would need tons of explosives, a delivery system, and a surreptitious means of evading armed
security guards. For a cyberterrorist, the same devastating result could be achieved by hacking into
the control network and commanding the computer to open the floodgates.
We are also seeing a migration of "traditional" crimes — including threats, child pornography, fraud,
gambling, and extortion — from the physical to the online world. When these crimes are carried out
online, perpetrators often find that the can reach more victims quickly and quite easily, turning what
were once "local" scams into crimes that cross interstate and international borders. Computers and
computer networks provide a cheap and powerful means of communications, and criminals take
advantage of this just like everyone else. In addition, sophisticated criminals can readily use the
easy anonymity that the Internet provides to hide their crimes.
Challenges of Cybercrime
The Internet and computers have brought tremendous benefits to our society, including greater
freedom of expression and economic growth. But we must also recognize that as a result of our
society's increasing reliance on technology, investigators and prosecutors at all levels —
international, federal, state, and local — are encountering unique challenges. These challenges
generally can be divided into three categories:
• Technical challenges that hinder law enforcement's ability to find and prosecute criminals
operating online;
• Legal challenges resulting from laws and legal tools needed to investigate cybercrime
158
lagging behind technological, structural, and social changes; and
• Resource challenges to ensure we have satisfied critical investigative and prosecutorial
needs at all levels of government.
Before I discuss each of these challenges, let me say that we recognize that we in government will
not be able to solve all of these problems. In fact, we believe the private sector should take the lead
in protecting private computer networks, through more vigilant security efforts, information sharing,
and, where appropriate, cooperation with government agencies. The private sector has the
resources, the technical ability, and the trained personnel to ensure that, as technology continues to
develop and change rapidly, the Internet is a safer place for all of us. Thus, the private sector can
and should take the lead on improving security practices and the development of a more secure
Internet infrastructure.
Our society will also need the assistance of the everyday user in making sure that safeguards are
taken and practices are followed. The best infrastructure and most secure means of electronic
commerce will be ineffective if the users of the technology, that is, all of us, don't follow the basic
"rules of the road."
However, even assuming that users and companies do everything they can to provide a safe,
secure, and vibrant Internet, there will be instances where the practices and safeguards fail.
Criminals rob banks even though banks use numerous security measures. In such cases, law
enforcement must be prepared and equipped to investigate and prosecute cybercriminals in order to
stop their criminal activity, to punish them, and to deter others who might follow the same path. This
is the reason that it is so important that we work together to address the challenges I am about to
discuss.
Technical Challenges
When a hacker disrupts air traffic control at a local airport, when a child pornographer sends
computer files, when a cyberstalker sends a threatening email to a public school or a local church,
or when credit card numbers are stolen from a company engaged in e−commerce, investigators
must locate the source of the communication. Everything on the Internet is communications, from
an e−mail to an electronic heist. Finding an electronic criminal means that law enforcement must
determine who is responsible for sending an electronic threat or initiating an electronic robbery. To
accomplish this, law enforcement must in nearly every case trace the "electronic trail" leading from
the victim back to the perpetrator.
Tracking a criminal online is not necessarily an impossible task, as demonstrated last year when
federal and state law enforcement agencies were able to track down the creator of the Melissa virus
and the individual who created a false Bloomburg News Service Web site in order to drive up the
stock price of PairGain, a telecommunications company in California. In both cases, technology
enabled us to find the individuals who were engaging in criminal activity.
Unfortunately, despite our successes in the Melissa and PairGain cases, we still face significant
challenges as online criminals become more sophisticated, often wearing the equivalent of Internet
electronic gloves to hide their fingerprints and their identity.
It doesn't take a master hacker to disappear on a network. Ironically, while the public is justifiably
worried about protecting the legitimate electronic privacy of individuals who use networks, a criminal
using tools and other information easily available over the Internet can operate in almost perfect
anonymity. By weaving his or her communications through a series of anonymous remailers; by
creating a few forged e−mail headers with powerful, point−and−click tools readily downloadable
from many hacker Web sites; or by using a "free−trial" account or two, a hacker, online
159
pornographer, or Web−based fraud artist can effectively hide the trail of his or her communications.
As we consider the challenge created by anonymity, we must also recognize that there are
legitimate reasons to allow anonymity in communications networks. A whistleblower, a resistance
fighter in Kosovo, a battered woman's support group — all of these individuals may understandably
wish to use the Internet and other new technologies to communicate with others without revealing
their identities.
In addition to problems related to the anonymous nature of the Internet, we are being challenged to
investigate and prosecute criminals in an international arena. The Internet is a global medium that
does not recognize physical and jurisdictional boundaries. A criminal no longer needs to be at the
actual scene of the crime to prey on his or her victims. As a result, a computer server running a
Web page designed to defraud U.S. senior citizens might be located in Europe or Asia. A child
pornographer may distribute photographs or videos via e−mail, sending the e−mails through the
communications networks of several countries before they reach their intended recipients. With
more than 190 Internet−connected countries in the world, the coordination challenges facing law
enforcement are tremendous. And any delay in an investigation is critical, as a criminal's trail might,
in certain circumstances, end as soon as he or she disconnects from the Internet.
Likewise, evidence of a crime can be stored at a remote location, either for the purpose of
concealing the crime from law enforcement and others, or simply because of the design of the
network. In certain circumstances, the fact that the evidence is stored and held by a third party,
such as an Internet service provider, might be helpful to law enforcement agencies who might be
able to use lawful process to get that information. However, storing information remotely can also
create a challenge to law enforcement, which cannot ignore the real−world limits of local, state, and
national sovereignty and jurisdiction. Obtaining information from foreign countries, especially on an
expedited basis, can be a daunting task, especially when a country may be in a different time zone,
use a different language, have different legal rules, and may not have trained experts available.
Consequently, even as the Internet and other new technologies have given us new abilities to find
criminals remotely, our abilities can be hindered if we cannot obtain the necessary legal cooperation
from our counterparts in other countries.
The vast majority of Internet companies are good corporate citizens and are interested in the safety
of our citizens. In fact, several companies have been engaged in discussions with law enforcement
regarding our concerns. Despite these efforts, we have learned that we cannot take for granted the
nature of any Internet service provider's services, its record−keeping practices, and its ability or
willingness to cooperate with us. We have encountered a handful of companies involved in criminal
activity. In addition, even those companies that are not involved in criminal activities might not be
able to assist us because of business reasons or privacy concerns that have resulted in them not
keeping the records that are necessary to investigate a particular crime.
Moreover, users connect to the Internet from anywhere in the world over old−fashioned telephone
lines, wireless phones, cable modems, and satellite systems. Each of these telecommunications
systems has its own protocols for addressing and routing traffic, which means that tracking all the
way back to the criminal at his or her computer will require agents to be fluent in each technical
language. Gathering this evidence from so many kinds of providers is a very different proposition
from the days when we simply obtained an order for a telephone company to trace a threatening
call.
160
Legal Challenges
Deterring and punishing computer criminals requires a legal structure that will support detection and
successful prosecution of offenders. Yet the laws defining computer offenses, and the legal tools
needed to investigate criminals using the Internet, can lag behind technological and social changes,
creating legal challenges to law enforcement agencies.
Some of the legal challenges we encounter can easily be corrected through legislative action. For
example, the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, arguably does not reach a
computer hacker who causes a large amount of damage to a network of computers if no individual
computer sustains over $5,000 worth of damage. The Department of Justice has encountered
several instances in which intruders have gained unauthorized access to protected computers
(whether publicly or privately owned) used in the provision of "critical infrastructure" systems and
services — such as those that hospitals use to store sensitive information and to treat patients, and
those that the military uses to defend the nation — but where proof of damage in excess of $5000
has not been readily available.
The laws under which we are able to identify the origin and destination of telephone calls and
computer messages also need to be reviewed. For example, under current law we may have to
obtain court orders in multiple jurisdictions to trace a single communication. Obtaining court orders
in multiple jurisdictions does not advance any reasonable privacy safeguard, yet it can be a
substantial impediment to a fast−paced investigation. As the Attorney General testified recently, it
might be extremely helpful, for example, to provide nationwide effect for trap and trace orders.
Another concern focuses on the problem of online threats and serious harassment — that is,
cyberstalking. Current federal law does not address those situations where a cyberstalker uses
unwitting third parties to bombard a victim with messages, transmits personal data about a person
— such as the route by which the victim's children walk to school — in order to place such person or
his family in fear of injury, or sends an e−mail or other communications under someone else's name
with the intent to abuse, harass, or threaten that person. We believe federal law may need to be
amended to address this gap.
These aren't hypothetical changes that we are proposing to address. Just ask the California woman
who was awakened six times in the middle of the night to find men knocking on her door offering to
rape her. She discovered that a man whom she had told she was not romantically interested in had
posted personal advertisements on a variety of Internet services pretending to be her. Each posting,
which contained her home address and telephone number, claimed that she fantasized about being
raped. We need to ensure that laws against harassment clearly prohibit such horrific actions,
particularly since access to the Internet means immediate access to a wide audience.
Resource Challenges
In addition to technical and legal challenges, we face significant resource challenges. Simply stated,
we need an adequate number of prosecutors and agents — at the federal, state and local level —
trained with the necessary skills and properly equipped to effectively fight all types of cybercrime.
While Congress has been very supportive of the Department's cybercrime efforts, we need
additional resources to ensure we are adequately equipped to continue our battle against
cybercriminals. The President has requested $37 million in new money in FY 2001 to expand our
staffing, training and technological capabilities to continue the fight against computer crime.
Together, these enhancements will increase the Department's 2001 funding base for computer
crime to $138 million, 28 percent more than in 2000.
161
Last, the Department of Justice would like to work with Congress to develop a comprehensive,
five−year plan — with FY 2001 as our baseline — to prevent cybercrime and, when it does occur, to
locate, identify, apprehend and bring to justice those responsible for these types of crimes. On
February 16th, the Attorney General testified before Congress regarding a proposed a 10−point
plan to identify the key areas we need to develop for our cybercrime capability. The key points of
this plan she touched upon include:
• Developing a round−the−clock network of federal, state and local law enforcement officials
with expertise in, and responsibility for, investigating and prosecuting cybercrime.
• Developing and sharing expertise — personnel and equipment — among federal, state and
local law enforcement agencies.
• Dramatically increasing our computer forensic capabilities, which are so essential in
computer crime investigations — both hacking cases and cases where computers are used
to facilitate other crimes, including drug trafficking, terrorism, and child pornography.
• Reviewing whether we have adequate legal tools to locate, identify, and prosecute
cybercriminals. In particular, we may need new and more robust procedural tools to allow
state authorities to more easily gather evidence located outside their jurisdictions. We also
need to explore whether we have adequate tools at the federal level to effectively investigate
cybercrime.
• Because of the borderless nature of the Internet, we need to develop effective partnerships
with other nations to encourage them to enact laws that adequately address cybercrime and
to provide assistance in cybercrime investigations. A balanced international strategy for
combating cybercrime should be at the top of our national security agenda.
• We need to work in partnership with industry to address cybercrime and security. This
should not be a top−down approach through excessive government regulation or mandates.
Rather, we need a true partnership, where we can discuss challenges and develop effective
solutions that do not pose a threat to individual privacy.
• And we need to teach our young people about the responsible use of the Internet. The
Department of Justice and the Information Technology Association of America have already
taken steps to do so through the development of the Cybercitizen Partnership, but more
needs to be done.
Efforts Against Cybercrime
Despite the technical, legal, and resource challenges, the Department has made strides in our fight
against cybercrime. We have and will continue to develop extensive investigatory and prosecutorial
programs to counter cybercrime. Let me take a few moments to details some of our efforts to date.
On the investigatory side, we have the FBI's National Infrastructure Protection Center (NIPC) and
specialized squads located in 16 field offices.
On the prosecutorial side, we have trained attorneys, both in headquarters and in the field, who are
experts in the legal, technological, and practical challenges involved in investigating and
prosecuting cybercrime. The cornerstone of our prosecutor cybercrime program is the Computer
Crime and Intellectual Property Section. CCIPS, which currently has 18 attorneys, was founded in
1991 as the Computer Crime Unit and was elevated to Section status in 1996. CCIPS works closely
on computer crime cases with Assistant United States Attorneys known as "Computer and
Telecommunications Coordinators" (CTCs) in U.S. Attorneys' Offices around the country. Each CTC
is given special training and equipment, and serves as the district's expert in computer crime cases.
As a result of these programs, the number of cases and prosecutions by the Department is growing
at a tremendous rate. For example, in 1998, U.S. Attorneys' Offices filed 85 computer crime cases
against 116 defendants. This represents a 29 percent increase in the number of cases filed and a
162
51 percent increase in the number of defendants, compared to the previous year. During that same
period of time, a total of 62 cases against 72 defendants were terminated, with 78 percent of those
defendants being convicted.
At the same time, our prosecutors are working with numerous other federal, state, and local
investigators and prosecutors, providing assistance in any case involving computers and other high
technology, such as computer searches and seizure. In sum, the Department and, in particular, its
investigators and prosecutors take seriously our responsibility to protect the nation's computers and
the Internet from computer crime.
In addition to the Department's efforts, other agencies including Customs, the Secret Service, the
Securities and Exchange Commission, and the U.S. Postal's Inspectors General, have played a role
in the investigation and prosecution of computer crimes.
Conclusion
On behalf of the Department, I want to thank Congress for all the support it has given to our efforts
to combat cybercrimes. Advancements in technology indicate that our efforts are only just
beginning. We look forward to working with Congress and the private sector to ensure that we have
a robust and effective long−term plan for combating cybercrime, protecting our nation's
infrastructure, and ensuring that the Internet reaches its full potential for expanding
communications, facilitating commerce, and bringing countless other benefits to our society.
The Melissa Virus
The Melissa virus first appeared on the Internet in March of 1999. It spread rapidly throughout
computer systems in the United States and Europe. It is estimated that the virus caused $80 million
in damages to computers worldwide. In the United States alone, the virus made its way through 1.2
million computers in one−fifth of the country's largest businesses. David Smith pleaded guilty on
December 9, 1999 to state and federal charges associated with his creation of the Melissa virus.
Three documents relating to the Melissa virus case are linked below:
• Information in United States of America v. David Smith — Court document filed by the U.S.
Attorney's Office in Newark, New Jersey relating to charges against the creator of the
Melissa computer virus. www.usdoj.gov/criminal/cybercrime/melinfo.htm
• Plea Agreement — David Smith agreed to plead guilty to creating and disseminating the
Melissa virus and causing over $80 million in damages, in violation of federal computer
crime laws. www.usdoj.gov/criminal/cybercrime/meliplea.htm
• Creator of 'Melissa' Computer Virus Pleads Guilty in New Jersey to State and Federal
Charges — www.usdoj.gov/criminal/cybercrime/melissa.htm
Cybercrime Summit: A Law Enforcement/Information
Technology Industry Dialogue
On April 5, 2000, the Department of Justice hosted a Cybercrime Summit at Stanford Law School,
titled "Cybercrime Summit:A Law Enforcement/Information Technology Industry Dialogue on
Prevention, Detection, Investigation and Cooperation," at which Attorney General Janet Reno and
members of the Justice Department and other law enforcement agencies met with representatives
163
of information technology and Internet companies. The main topic of the Summit was how to
improve cooperation between law enforcement and industry in investigating computer network
hacking. Linked below are the Attorney General's Opening Remarks from the Summit, as well as
the Question & Answer session between industry representatives and the Attorney General.
• Opening Remarks of Attorney General Janet Reno at the Cybercrime Summit —
www.usdoj.gov/criminal/cybercrime/agcybsum.htm
• Question and Answer Session with Attorney General Janet Reno at the Cybercrime Summit
— www.usdoj.gov/criminal/cybercrime/4500agcybercrimes.htm
164
Chapter 10: International Aspects of Computer Crime
With the explosive growth of the Internet worldwide, computer crimes increasingly are prone to have
international dimensions. Some of the challenges faced by law enforcement on the international
front include: harmonization of countries' criminal laws; locating and identifying perpetrators across
borders; and securing electronic evidence of their crimes so that they may be brought to justice.
Complex jurisdictional issues arise at each step. The Department of Justice is working with foreign
governments through many channels to address global threats related to computer crime.
Council of Europe Convention on Cybercrime
On April 27, 2000, the Council of Europe released its draft Convention on CyberCrime, which is the
first multilateral instrument drafted to address the problems posed by the spread of criminal activity
on computer networks. The United States has participated in the drafting of the Council of Europe
Convention, which is still a work in progress, since the project began over two years ago. The
drafting group is scheduled to complete its work by December 31, 2000, but it continually releases
new drafts. The Convention will then be finalized by the Steering Committee on European Crime
Problems and submitted to the Committee of Ministers for adoption before it is opened to members
of the Council of Europe and observer nations, including the United States, for signature.
The text of the explanatory memorandum of the Convention, the draft Convention and the
accompanying press release are available at conventions.coe.int/treaty/EN/cadreproject.htm
Draft Convention on Cyber−Crime
Version No. 27 Revised
This text prepared by Committee of Experts on Crime in Cyber−Space (PC−CY), was submitted to
the European Committee on Crime Problems (CDPC) at its 50th plenary session (18–22 June
2001). The text will be submitted to the Committee of Ministers for adoption.
This document, provisionally entitled "Draft Convention on Cyber−Crime," is the first ever
international treaty to address criminal law and procedural aspects of various types of criminal
behavior directed against computer systems, networks or data and other types of similar misuse. A
list of contact points in certain negotiating States is also provided herewith to allow interested
parties to submit comments or questions on the draft treaty to national government experts.
It also contains the draft Explanatory Memorandum which has been made public to help readers
of the draft Convention better understand the scope and meaning of its provisions, as intended by
the drafters. Explanations provided in this document should therefore be read in conjunction with
the draft treaty's provisions.
Supervisory Authorities and Transborder Data Flows
Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic
Processing of Personal Data (ETS No. 108)
[ETS No. 179]
[Strasbourg,8.XI.2001]
165
Preamble
The Parties to this additional Protocol to the Convention for the Protection of Individuals with regard
to Automatic Processing of Personal Data, opened for signature in Strasbourg on 28 January 1981
(hereafter referred to as "the Convention"); convinced that supervisory authorities, exercising their
functions in complete independence, are an element of the effective protection of individuals with
regard to the processing of personal data;
Considering the importance of the flow of information between peoples; considering that, with the
increase in exchanges of personal data across national borders, it is necessary to ensure the
effective protection of human rights and fundamental freedoms, and in particular the right to privacy,
in relation to such exchanges of personal data,
Have agreed as follows:
Article 1: Supervisory authorities
1. Each Party shall provide for one or more authorities to be responsible for ensuring
compliance with the measures in its domestic law giving effect to the principles stated in
Chapters II and III of the Convention and in this Protocol.
2.
a. To this end, the said authorities shall have, in particular, powers of investigation and
intervention, as well as the power to engage in legal proceedings or bring to the
attention of the competent judicial authorities violations of provisions of domestic law
giving effect to the principles mentioned in paragraph 1 of Article 1 of this Protocol.
b. Each supervisory authority shall hear claims lodged by any person concerning the
protection of his/her rights and fundamental freedoms with regard to the processing
of personal data within its competence.
3. The supervisory authorities shall exercise their functions in complete independence.
4. Decisions of the supervisory authorities, which give rise to complaints, may be appealed
against through the courts.
5. In accordance with the provisions of Chapter IV, and without prejudice to the provisions of
Article 13 of the Convention, the supervisory authorities shall co−operate with one another to
the extent necessary for the performance of their duties, in particular by exchanging all
useful information.
Article 2: Transborder flows of personal data to a recipient which is not subject to the jurisdiction of a Party to
the Convention
1. Each Party shall provide for the transfer of personal data to a recipient that is subject to the
jurisdiction of a State or organisation that is not Party to the Convention only if that State or
organisation ensures an adequate level of protection for the intended data transfer.
2. By way of derogation from paragraph 1 of Article 2 of this Protocol, each Party may allow for
the transfer of personal data:
a. if domestic law provides for it because of:
i. specific interests of the data subject, or
ii. legitimate prevailing interests, especially important public interests, or
b. if safeguards, which can in particular result from contractual clauses, are provided by
the controller responsible for the transfer and are found adequate by the competent
authorities according to domestic law.
166
Article 3: Final provisions
1. The provisions of Articles 1 and 2 of this Protocol shall be regarded by the Parties as
additional articles to the Convention and all the provisions of the Convention shall apply
accordingly.
2. This Protocol shall be open for signature by States Signatories to the Convention. After
acceding to the Convention under the conditions provided by it, the European Communities
may sign this Protocol. This Protocol is subject to ratification, acceptance or approval. A
Signatory to this Protocol may not ratify, accept or approve it unless it has previously or
simultaneously ratified, accepted or approved the Convention or has acceded to it.
Instruments of ratification, acceptance or approval of this Protocol shall be deposited with
the Secretary General of the Council of Europe.
3.
a. This Protocol shall enter into force on the first day of the month following the expiry of
a period of three months after the date on which five of its Signatories have
expressed their consent to be bound by the Protocol in accordance with the
provisions of paragraph 2 of Article 3.
b. In respect of any Signatory to this Protocol which subsequently expresses its consent
to be bound by it, the Protocol shall enter into force on the first day of the month
following the expiry of a period of three months after the date of deposit of the
instrument of ratification, acceptance or approval.
4.
a. After the entry into force of this Protocol, any State which has acceded to the
Convention may also accede to the Protocol.
b. Accession shall be effected by the deposit with the Secretary General of the Council
of Europe of an instrument of accession, which shall take effect on the first day of the
month following the expiry of a period of three months after the date of its deposit.
5.
a. Any Party may at any time denounce this Protocol by means of a notification
addressed to the Secretary General of the Council of Europe.
b. Such denunciation shall become effective on the first day of the month following the
expiry of a period of three months after the date of receipt of such notification by the
Secretary General.
6. The Secretary General of the Council of Europe shall notify the member States of the
Council of Europe, the European Communities and any other State which has acceded to
this Protocol of:
a. any signature;
b. the deposit of any instrument of ratification, acceptance or approval;
c. any date of entry into force of this Protocol in accordance with Article 3;
d. any other act, notification or communication relating to this Protocol.
In witness whereof the undersigned, being duly authorised thereto, have signed this Protocol.
Done at [Strasbourg], this [8th day of November 2001], in English and in French, both texts being
equally authentic, in a single copy which shall be deposited in the archives of the Council of Europe.
The Secretary General of the Council of Europe shall transmit certified copies to each member
State of the Council of Europe, the European Communities and any State invited to accede to the
Convention.
167
The text will increase the protection of personal data and privacy by improving the original
Convention of 1981 in two areas. First, it provides for the setting up of national supervisory
authorities responsible for ensuring compliance with laws or regulations adopted in pursuance of the
convention, concerning personal data protection and transborder data flows. The second
improvement concerns transborder data flows to third countries. Data may only be transferred if the
recipient State or international organisation is able to afford an adequate level of protection.
This Protocol will be open for signature in Strasbourg on 8 November 2001, on the occasion of the
109th Session of the Committee of Ministers of the Council of Europe.
The main aim of this Additional Protocol is to amend and supplement in certain areas, as between
the Parties to the Protocol, the provisions of the Agreement, in particular with a view to increasing
and improving the co−operation between Central Authorities, facilitating the communications
between lawyers and applicants and improving the efficiency in the application of the Agreement by
Central Authorities.
This Protocol will be open for signature in Strasbourg on 8 November 2001, on the occasion of the
109th Session of the Committee of Ministers of the Council of Europe.
Press Release on the Council of Europe Draft Convention on Cybercrime (April 27, 2000) is
available at www.usdoj.gov/criminal/cybercrime/coepress.htm
Council of Europe Convention on Cybercrime Frequently Asked
Questions
Background and Process
Answers
Structure of the Convention
Answers
Substantive Offense and Domestic Procedural Provisions
Answers
Internet as the Scene of Crime
On May 29, 2000, Assistant Attorney General James K. Robinson spoke at the International
Computer Crime Conference in Oslo, Norway, on "Internet as the Scene of Crime." His speech
addressed the types of computer crime that exist, as well as the legal and technical challenges that
face law enforcement and prosecutors in their efforts to combat this crime. The speech is available
at www.usdoj.gov/criminal/cybercrime/roboslo.htm.
168
Challenges Presented to Law Enforcement by High−Tech and
Computer Criminals
Attorney General Janet Reno's speech to Senior Experts representing the G−7 on January 21, 1997
On January 21, 1997, Attorney General Janet Reno spoke to Senior Experts representing the G−7
group of leading industrialized nations (now, with the inclusion of Russia, known as The Eight). The
Attorney General's speech addressed the challenges presented to law enforcement by high−tech
and computer criminals, and she suggested a number ways in which the United States and its allies
can respond to this global threat. Her speech is available at
www.usdoj.gov/criminal/cybercrime/agfranc.htm.
Problems of Criminal Procedural Law Connected with
Information Technology
Council of Europe Recommendation 95(13)
In September 1995, the Council of Europe adopted eighteen (18) recommendations relating to
problems of criminal procedural law connected with information technology. These
recommendations are available at www.usdoj.gov/criminal/cybercrime/crycoe.htm.
Combating High−Tech and Computer−Related Crime
Meeting of the Justice and Interior Ministers of The Eight, on December 9 and 10, 1997, in
Washington, D.C.
On December 9 and 10, 1997, Attorney General Reno convened a first−ever meeting on crime of
her counterparts from The Eight (formerly known as the G−7 plus Russia) countries: England,
France, Germany, Italy, Russia, Japan, and Canada. In all, sixteen Ministers and Deputy Ministers
attended.
The subject of the meeting was transnational organized crime, and its focus was on combatting
high−tech and computer−related crime. On December 10, the Ministers adopted a Communique
which contained 10 Principles and 10 Action Items relating to high−tech crime. This document is the
outgrowth of the work of the Subgroup of The Eight on High−tech Crime, which met five times in
1997, and is working to develop the tools that law enforcement needs to locate and identify
computer criminals, and gather evidence of their crimes so that they may be brought to justice. The
10 Principles they adopted are given below:
Principles to Combat High−Tech Crime
1. There must be no safe havens for those who abuse information technologies.
2. Investigation and prosecution of international high−tech crimes must be coordinated among
all concerned States, regardless of where harm has occurred.
3. Law enforcement personnel must be trained and equipped to address hightech crimes.
4. Legal systems must protect the confidentiality, integrity, and availability of data and systems
from unauthorized impairment and ensure that serious abuse is penalized.
169
5. Legal systems should permit the preservation of and quick access to electronic data, which
are often critical to the successful investigation of crime.
6. Mutual assistance regimes must ensure the timely gathering and exchange of evidence in
cases involving international high−tech crime.
7. Transborder electronic access bylaw enforcement to publicly available (open source)
information does not require authorization from the State where the data resides.
8. Forensic standards for retrieving and authenticating electronic data for use in criminal
investigations and prosecutions must be developed and employed.
9. To the extent practicable, information and telecommunications systems should be designed
to help prevent and detect network abuse, and should also facilitate the tracing of criminals
and the collection of evidence.
10. Work in this area should be coordinated with the work of other relevant international forums
to ensure against duplication of efforts.
Action Plan to Combat High−Tech Crime
In support of the Principles, we are directing our officials to:
1. Use our established network of knowledgeable personnel to ensure a timely, effective
response to transnational high−tech cases and designate a point−of−contact who is
available on a twenty−four hour basis.
2. Take appropriate steps to ensure that a sufficient number of trained and equipped law
enforcement personnel are allocated to the task of combating high−tech crime and assisting
law enforcement agencies of other States.
3. Review our legal systems to ensure that they appropriately criminalize abuses of
telecommunications and computer systems and promote the investigation of high−tech
crimes.
4. Consider issues raised by high−tech crimes, where relevant, when negotiating mutual
assistance agreements or arrangements.
5. Continue to examine and develop workable solutions regarding: the preservation of
evidence prior to the execution of a request for mutual assistance; transborder searches;
and computer searches of data where the location of that data is unknown.
6. Develop expedited procedures for obtaining traffic data from all communications carriers in
the chain of a communication and to study ways to expedite the passing of this data
internationally.
7. Work jointly with industry to ensure that new technologies facilitate our effort to combat
high−tech crime by preserving and collecting critical evidence.
8. Ensure that we can, in urgent and appropriate cases, accept and respond to mutual
assistance requests relating to high−tech crime by expedited but reliable means of
communications, including voice, fax, or e−mail, with written confirmation to follow where
required.
9. Encourage internationally recognized standards−making bodies in the fields of
telecommunications and information technologies to continue providing the public and
private sectors with standards for reliable and secure telecommunications and data
processing technologies.
10. Develop and employ compatible forensic standards for retrieving and authenticating
electronic data for use in criminal investigations and prosecutions.
170
Vienna International Child Pornography Conference
Deputy Attorney General Eric Holder's welcoming remarks, September 29, 1999
On September 29, 1999, Deputy Attorney General Eric Holder gave remarks on "Combating Child
Pornography on the Internet" at Vienna, Austria International Child Pornography Conference. The
conference sought to combat child pornography and exploitation on the Internet and was based on
existing international obligations and commitments for the protection of children, including the
Convention on the Rights of the Child. The conference built and acted upon commitments
undertaken at the Stockholm World Congress against the Commercial Sexual Exploitation of
Children (1996) and ongoing initiatives in many countries and regions.
Remarks of U.S. Deputy Attorney General Eric Holder on "Combating Pornography on the Internet"
at the Vienna, Austria International Child Pornography Conference (September 29, 1999), are
available at www.usdoj.gov/criminal/cybercrime/dagceos.htm
OECD Guidelines for Cryptography Policy
In early 1996 the Organization for Economic Cooperation and Development (OECD) initiated a
project on cryptography policy by forming the Ad hoc Group of Experts on Cryptography Policy
Guidelines. The Ad hoc Group was charged with drafting Guidelines for Cryptography Policy
("Guidelines") to identify the issues which should be taken into consideration in the formulation of
cryptography policies at the national and international level. The Ad hoc Group had a one year
mandate to accomplish this task and it completed its work in December 1996. Thereafter, the
Guidelines were adopted as a Recommendation of the Council of the OECD on 27 March 1997.
Fighting Cybercrime: What are the Challenges Facing Europe?
Deputy Assistant Attorney General DiGregory's Remarks before the European Parliament on
International Cooperation in Combating Cybercrime, September 19, 2000
On September 19, 2000 Deputy Assistant Attorney General Kevin DiGregory spoke before a
conference in the European Parliament that was entitled "Fighting Cybercrime: What are the
Challenges Facing Europe?" DiGregory discussed the Transatlantic perspective on combating
cybercrime, including international cooperation.
Deputy Assistant Attorney General DiGregory's Remarks before the European Parliament
(September 19, 2000) are available at www.usdoj.gov/criminal/cybercrime/EUremarks.htm.
171
Chapter 11: Privacy Issues in the High−Tech Context
The Department of Justice Privacy Council
On December 7, 1998, Attorney General Janet Reno established the Department of Justice Privacy
Council. In her memorandum to heads of components of the Justice Department, the Attorney
General cites new challenges that have arisen as a result of the proliferation of new technologies as
the main reason for the establishment of the Council. The purpose of the Privacy Council is to
address privacy concerns in a comprehensive and coordinated way.
Law Enforcement Concerns Related to Computerized Databases
The Computer Crime and Intellectual Property Section of the Department of Justice submitted
comments in response to the request of the Federal Trade Commission ("FTC") for comments on its
workshop on Consumer Information Privacy and its Database Study. The Department is deeply
concerned about the safety and security of American citizens. The Department is vigilant to take
appropriate measures to guard their privacy while using all the resources at its disposal, including
information resources, to investigate and prosecute violations of the federal criminal law. The
comments are listed in Exhibit 1.
Exhibit 1: CCIPS Comments as Submitted to the FTC Workshop on Consumer Information Privacy
and Database Study
Secretary, Federal Trade Commission
Room H−159
Sixth Street & Pennsylvania Ave., NW
Washington, D.C. 20580
Re: Database Study — Comment, P974806
Database Workshop — Request to Participate, P974806
To the Federal Trade Commission:
The Department of Justice ("Department") hereby submits these comments in response to the
request of the Federal Trade Commission ("FTC") for comments on its workshop on Consumer
Information Privacy and its Database Study. Pursuant to the FTC's request, the Department
requests the opportunity to participate in the Database Workshop by submission of these
comments.
The Department, of which Federal Bureau of Investigation is a part, is an executive branch agency
charged with federal law enforcement responsibilities. The Department is deeply concerned about
the safety and security of American citizens. The Department is vigilant to take appropriate
measures to guard their privacy while using all the resources at its disposal, including information
resources, to investigate and prosecute violations of the federal criminal law.
The FTC invited comment about the collection, compilation, sale, and use of computerized
databases that provide sensitive consumer identifying information. Public Workshop on Consumer
172
Information Privacy, 62 Fed. Reg. 10271, 10272−73 (1997) In particular, Question 1.24 asks about
federal laws regulating such activity. Question 1.26 asks whether additional regulations or laws are
necessary or appropriate.
No federal law regulates such activity on a general basis. The FTC is familiar with the scope and
limitations of the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., which imposes restrictions on
the furnishing of a "consumer report" by a "consumer reporting agency." FTC policy has been to
treat market lists from a credit reporting database based on such "identifying information" as name,
zip code, age, social security number or "substantially similar identifiers," as not rising to the level of
a "consumer report." See Trans Union Corp. v. FTC, 81 F.3d 228, 232 (D.C. Cir. 1996) (discussing
Letter from FTC to TRW, September 24, 1992).
Other federal laws are subject to their own limitations. The Privacy Act, for example, applies to
government entities only. 5 U.S.C. § 552a. See 5 U.S.C. § 552(f) (definition of "agency"). The Social
Security Act has an analogous provision prohibiting disclosure of Social Security account numbers
and related records by "authorized persons," who are defined as including only government
employees. 42 U.S.C. § 405(c)(2)(C)(vii). The Social Security Act also provides penalties for fraud
related to procurement of Social Security number information. 42 U.S.C. § 1307(b).
On an ad hoc basis, Congress has occasionally protected privacy of records with regard to
particular records or particular industries. These protections relate to financial records, 12 U.S.C. §
3401−34, drivers licenses, 18 U.S.C. § 2721, wire and electronic communications records, 18
U.S.C. § 2703, video rentals, 18 U.S.C. § 2710−2711, and telephone network customer information,
42 U.S.C. § 222.
These restrictions on use of sensitive records are important to protect American citizens. They
serve not only to protect the dignity of Americans by keeping their personal information private, but
also to deter identity fraud and other kinds of fraud. Deterring fraud is an important federal law
enforcement interest. See, e.g., 18 U.S.C. § 1002 (possession of false papers to defraud the United
States), 18 U.S.C. § 1028 (fraud and related activity in connection with identification documents), 18
U.S.C. § 1029 (fraud and related activity in connection with access devices). See also 18 U.S.C. §
1341 (mail fraud); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1344 (bank fraud). This concern takes
on added significance in the context of computers, where access often occurs without face−to−face
interactions. See 18 U.S.C. § 1030.
Congress has repeatedly recognized that the needs for protecting privacy and deterring fraud must
be balanced by the need for effective law enforcement. All of the industry−specific provisions
mentioned above permit reasonable access by law enforcement. See, e.g., 12 U.S.C. § 3413(a)−(o)
(financial records); 18 U.S.C. § 2703(c)(1)(C) (local and long distance telephone toll billing records);
18 U.S.C. § 2710(b)(2)(C) (video tape rental records).
In the absence of incentives to the contrary, collection, compilation, sale, and use of computerized
databases that provide sensitive consumer identifying information will likely proliferate with the rise
of electronic commerce and other cyberspace activity. This increase would be driven both on the
supply side and on the demand side of the market. Because electronic commerce is conducted on
computers, the supply of consumer identifying information stored on computers in an easily
accessible format will increase as use of electronic commerce increases.
The demand for this information is likely to be potent because of its marketing value for those
companies who collect it, both for evaluating preferences of particular customers and for estimating
the appeal of particular products and services. This information will also be sought by other
companies who would use it for similar purposes. In fact, as face−to−face interactions decrease,
173
companies will increasingly rely on such information to "profile" market segments.
The proliferation of these computerized databases will simplify the perpetration of many kinds of
fraud, including identity fraud. The Department is concerned about this potential.
Law enforcement is also faced with concerns about the decrease in direct interactions between
individuals. The rise of electronic commerce will not only facilitate crimes such as money
laundering, 18 U.S.C. § 1956, but it will also affect the availability of investigative leads and
evidence. Computerized databases will become increasingly important in the investigation and
prosecution of all kinds of crime. No longer will it be possible to interview bystanders about the
where−abouts of an individual. Instead, crimes will have to be traced electronically.
Society's continual recognition of the need for reasonable law enforcement access to otherwise
protected records should be preserved in the area of computerized databases. A desire for
anonymity in the world of electronic commerce should not be used as a cover to avoid
accountability. Policy makers must be vigilant for unintended consequences of privacy laws that, if
written without procedures for access by law enforcement, could severely hinder public safety
efforts. Of course, the procedures for government access should be tailored to the type of
information at issue and ensure that privacy is appropriately protected.
The Department appreciates the opportunity to share these views with the FTC.
Respectfully submitted,
Scott Charney
Chief, Computer Crime and Intellectual Property Section
Enforcing the Criminal Wiretap Statute
The Computer Crime and Intellectual Property Section helps to protect the privacy of Americans by
enforcing the criminal wiretap statute, 18 U.S.C. § 2511. One well−publicized interception involved a
conference call in which the Speaker of the House Newt Gingrich participated. The couple that
intercepted the call pleaded guilty on April 25, 1997, as is described in the press release at
www.usdoj.gov/criminal/cybercrime/177crm.htm.
On September 8, 1998, a Sheriff in North Carolina pled guilty to wiretapping and recording a high
school teacher's telephone calls, which the Sheriff intended to use to force the teacher out of his
job. The information is available at www.usdoj.gov/criminal/cybercrime/sheriff.htm.
Referring Potential Privacy Violations to the Department of
Justice for Investigation and Prosecution
Recently, Deputy Attorney General Eric Holder wrote a memo to the Inspector General community
encouraging them to refer potential violations of federal privacy statutes to the Department of
Justice for investigation and prosecution. The letter provides an overview of federal privacy laws,
including the Privacy Act, and explains the sentencing guidelines associated with particular
174
violations. The letter further directs that all suspected 1030(a)(2) offenses should be referred to the
Computer Crime and Intellectual Property Section. The information is available at
www.usdoj.gov/criminal/cybercrime/igprivacy.htm.
Testimony on Digital Privacy
On September 6, 2000, Deputy Assistant Attorney General Kevin V. DiGregory testified before
Senate Committee on the Judiciary about the FBI computer program "Carnivore." He addressed the
imperative of protecting individual privacy on the Internet from unwarranted governmental intrusion,
and the critical role the Department plays to ensure that the Internet is a safe and secure place for
our citizens. [See http://www.cybercrime.gov/kvd_0906b.htm.]
On September 6, 2000, Deputy Assistant Attorney General Kevin V. DiGregory testified before the
Subcommittee on the Constitution of the House Committee on the Judiciary on the subject of the
two new bills proposed by members of the Subcommittee: H.R. 5018, "The Electronic
Communications Privacy Act of 2000," and H.R. 4987, "The Digital Privacy Act of 2000." His
testimony detailed the ways in which technological advances challenge law enforcement ability to
fulfill its duty to protect public safety and discussed the serious concerns raised by the introduced
bills. [See http://www.cybercrime.gov/kvd_060900.htm.]
Kevin V. DiGregory, Deputy Assistant Attorney General, testified before the Subcommittee on the
Constitution of the House Committee on the Judiciary on July 24, 2000. This statement addressed
the law enforcement tool "Carnivore" and its impact on Internet privacy and the Fourth Amendment.
[See http://www.cybercrime.gov/carnivore.htm.]
On April 6, 2000, Deputy Assistant Attorney General Kevin V. DiGregory testified before the
Subcommittee on the Constitution of the House Committee on the Judiciary on the subject of the
Fourth Amendment and the Internet. His testimony detailed the ways in which the Fourth
Amendment protects the privacy of Internet users. Also covered were the new technical challenges
that face law enforcement and possible solutions for overcoming these challenges. [See
http://www.cybercrime.gov/inter4th.htm.]
On March 27, 2000, John T. Bentivoglio, Special Counsel for Health Care Fraud and Chief Privacy
Officer at the U.S. Department of Justice, gave remarks on the prosecution of health care fraud and
the protection of health care privacy on the Internet. His speech focused on the federal
government's fraud, consumer protection, and privacy protection efforts as they relate to the Internet
h e a l t h c a r e i n d u s t r y . [ T h e i n f o r m a t i o n i s a v a i l a b l e a t
www.usdoj.gov/criminal/cybercrime/healthsp.htm.]
On May 27, 1999, the Subcommittee on Courts and Intellectual Property of the Judiciary
Committee, United States House of Representatives, convened a hearing on medical records
privacy. John T. Bentivoglio, the Justice Department's Chief Privacy Officer, testified before the
committee on the subject of digital privacy in general. The testimony outlines the Department's
privacy initiatives, including the work of the Privacy Council and comments on industry−led privacy
safeguarding measures. The testimony also addresses problems that result from failures to protect
privacy, from Internet fraud to identity theft. [The information is available at
www.usdoj.gov/criminal/cybercrime/digpriv.htm.]
175
Chapter 12: Critical Infrastructure Protection
Our national defense, public safety, economic prosperity, and quality of life have long depended on
the efficient delivery of essential services — energy, banking and finance, transportation, vital
human services, and telecommunications. The rapid growth and integration of the
telecommunications infrastructure has made all of these sectors interdependent, and in the process,
created unprecedented risks. CCIPS has long been involved in investigations of cyber−attacks; the
entire federal sector is now organizing to address these new threats.
The Department of Justice and the FBI rose to the challenge by creating the National Infrastructure
Protection Center (NIPC) in early 1998. On May 22, 1998, the President issued Presidential
Decision Directive 63 (PDD−63), which called for the creation of a national plan to protect the
services on which we depend daily.
Attorney General Janet Reno's Speech on Critical Infrastructure
Protection
On February 27, 1998, Attorney General Janet Reno addressed the Conference on Critical
Infrastructure Protection, held at Lawrence Livermore Laboratories, in Livermore, California, to
announce the formation of the National Infrastructure Protection Center (NIPC) at FBI Headquarters
in Washington, D.C. The Center is a joint government and private sector partnership, including
representatives from the relevant agencies of federal, state, and local governments, and the private
sector, to address the daunting challenge of protecting the critical infrastructures on which our
nation depends. The NIPC is designated as the national focal point for threat assessment, warning,
investigation, and response to attacks on the critical infrastructures. The concept for the NIPC grew
out of the Report of the President's Commission on Critical Infrastructure Protection [see "Protecting
the Nation's Critical Infrastructures: Presidential Decision Directive 63" below] and from the
government's experiences in dealing with illegal intrusions into government and private sector
computer systems over the last five years.
Protecting the Nation's Critical Infrastructures: Presidential
Decision Directive 63
On May 22, 1998, President Clinton announced two new directives designed to strengthen the
Nation's defenses against terrorism and other unconventional threats: Presidential Decision
Directives (PDD) 62 and 63. PDD−63 focuses specifically on protecting the Nation's critical
infrastructures from both physical and "cyber" attack. These attacks may come from foreign
governments, foreign and domestic terrorist organizations, and foreign and domestic criminal
organizations. The NIPC is a part of the broader framework of government efforts established by
PDD−63.
This Presidential Directive builds on the recommendations of the President's Commission on Critical
Infrastructure Protection. In October 1997 the Commission issued its report, calling for a national
effort to assure the security of the United States' increasingly vulnerable and interconnected
infrastructures, such as telecommunications, banking and finance, energy, transportation, and
essential government services.
Presidential Decision Directive 63 is the culmination of an intense, interagency effort to evaluate
those recommendations and produce a workable and innovative framework for critical infrastructure
176
protection. The President's policy:
• Sets a goal of a reliable, interconnected, and secure information system infrastructure by the
year 2003, and significantly increased security for government systems by the year 2000,
by:
♦ Immediately establishing a national center to warn of and respond to attacks
♦ Building the capability to protect critical infrastructures from intentional acts by 2003
♦ Addresses the cyber and physical infrastructure vulnerabilities of the Federal
Government by requiring each department and agency to work to reduce its
exposure to new threats
• Requires the Federal Government to serve as a model to the rest of the country for how
infrastructure protection is to be attained;
• Seeks the voluntary participation of private industry to meet common goals for protecting our
critical systems through public−private partnerships;
• Protects privacy rights and seeks to utilize market forces. It is meant to strengthen and
protect the nation's economic power, not to stifle it.
• Seeks full participation and input from the Congress.
PDD−63 sets up a new structure to deal with this important challenge:
• A National Coordinator whose scope will include not only critical infrastructure but also
foreign terrorism and threats of domestic mass destruction (including biological weapons)
because attacks on the U.S. may not come labeled in neat jurisdictional boxes;
• The National Infrastructure Protection Center (NIPC) at the FBI which will fuse
representatives from FBI, DOD, USSS, Energy, Transportation, the Intelligence Community,
and the private sector in an unprecedented attempt at information sharing among agencies
in collaboration with the private sector. The NIPC will also provide the principal means of
facilitating and coordinating the Federal Government's response to an incident, mitigating
attacks, investigating threats and monitoring reconstitution efforts;
• An Information Sharing and Analysis Center (ISAC) is encouraged to be set up by the
private sector, in cooperation with the federal government;
• A National Infrastructure Assurance Council drawn from private sector leaders and
state/local officials to provide guidance to the policy formulation of a National Plan;
• The Critical Infrastructure Assurance Office will provide support to the National Coordinator's
work with government agencies and the private sector in developing a national plan. The
office will also help coordinate a national education and awareness program, and legislative
and public affairs.
The Clinton Administration's Policy on Critical Infrastructure
Protection: Presidential Decision Directive 63
This White Paper explains key elements of the Clinton Administration's policy on critical
infrastructure protection. It is intended for dissemination to all interested parties in both the private
and public sectors. It will also be used in U.S. Government professional education institutions, such
as the National Defense University and the National Foreign Affairs Training Center, for course work
and exercises on interagency practices and procedures. Wide dissemination of this unclassified
White Paper is encouraged by all agencies of the U.S. Government.
177
A Growing Potential Vulnerability
The United States possesses both the world's strongest military and its largest national economy.
Those two aspects of our power are mutually reinforcing and dependent. They are also increasingly
reliant upon certain critical infrastructures and upon cyber−based information systems.
Critical infrastructures are those physical and cyber−based systems essential to the minimum
operations of the economy and government. They include, but are not limited to,
telecommunications, energy, banking and finance, transportation, water systems and emergency
services, both governmental and private. Many of the nation's critical infrastructures have
historically been physically and logically separate systems that had little interdependence. As a
result of advances in information technology and the necessity of improved efficiency, however,
these infrastructures have become increasingly automated and interlinked. These same advances
have created new vulnerabilities to equipment failures, human error, weather and other natural
causes, and physical and cyber attacks. Addressing these vulnerabilities will necessarily require
flexible, evolutionary approaches that span both the public and private sectors, and protect both
domestic and international security.
Because of our military strength, future enemies, whether nations, groups or individuals, may seek
to harm us in non−traditional ways including attacks within the United States. Our economy is
increasingly reliant upon interdependent and cyber−supported infrastructures and non−traditional
attacks on our infrastructure and information systems may be capable of significantly harming both
our military power and our economy.
President's Intent
It has long been the policy of the United States to assure the continuity and viability of critical
infrastructures. President Clinton intends that the United States will take all necessary measures to
swiftly eliminate any significant vulnerability to both physical and cyber attacks on our critical
infrastructures, including especially our cyber systems.
A National Goal
No later than the year 2000, the United States shall have achieved an initial operating capability and
no later than five years from the day the President signed Presidential Decision Directive 63 the
United States shall have achieved and shall maintain the ability to protect our nation's critical
infrastructures from intentional acts that would significantly diminish the abilities of:
• The Federal Government to perform essential national security missions and to ensure the
general public health and safety;
• State and local governments to maintain order and to deliver minimum essential public
services;
• The private sector to ensure the orderly functioning of the economy and the delivery of
essential telecommunications, energy, financial and transportation services.
Any interruptions or manipulations of these critical functions must be brief, infrequent, manageable,
geographically isolated and minimally detrimental to the welfare of the United States.
A Public−Private Partnership to Reduce Vulnerability
Since the targets of attacks on our critical infrastructure would likely include both facilities in the
economy and those in the government, the elimination of our potential vulnerability requires a
178
closely coordinated effort of both the public and the private sector. To succeed, this partnership
must be genuine, mutual and cooperative. In seeking to meet our national goal to eliminate the
vulnerabilities of our critical infrastructure, therefore, the U.S. government should, to the extent
feasible, seek to avoid outcomes that increase government regulation or expand unfunded
government mandates to the private sector.
For each of the major sectors of our economy that are vulnerable to infrastructure attack, the
Federal Government will appoint from a designated Lead Agency a senior officer of that agency as
the Sector Liaison Official to work with the private sector. Sector Liaison Officials, after discussions
and coordination with private sector entities of their infrastructure sector, will identify a private sector
counterpart (Sector Coordinator) to represent their sector.
Together these two individuals and the departments and corporations they represent shall
contribute to a sectoral National Infrastructure Assurance Plan by:
• Assessing the vulnerabilities of the sector to cyber or physical attacks;
• Recommending a plan to eliminate significant vulnerabilities;
• Proposing a system for identifying and preventing attempted major attacks;
• Developing a plan for alerting, containing and rebuffing an attack in progress and then, in
coordination with FEMA as appropriate, rapidly reconstituting minimum essential capabilities
in the aftermath of an attack.
During the preparation of the sectoral plans, the National Coordinator (see ["Structure and
Organization"]), in conjunction with the Lead Agency Sector Liaison Officials and a representative
from the National Economic Council, shall ensure their overall coordination and the integration of
the various sectoral plans, with a particular focus on interdependencies.
Guidelines
In addressing this potential vulnerability and the means of eliminating it, President Clinton wants
those involved to be mindful of the following general principles and concerns.
• We shall consult with, and seek input from, the Congress on approaches and programs to
meet the objectives set forth in this directive.
• The protection of our critical infrastructures is necessarily a shared responsibility and
partnership between owners, operators and the government. Furthermore, the Federal
Government shall encourage international cooperation to help manage this increasingly
global problem.
• Frequent assessments shall be made of our critical infrastructures' existing reliability,
vulnerability and threat environment because, as technology and the nature of the threats to
our critical infrastructures will continue to change rapidly, so must our protective measures
and responses be robustly adaptive.
• The incentives that the market provides are the first choice for addressing the problem of
critical infrastructure protection; regulation will be used only in the face of a material failure of
the market to protect the health, safety or well−being of the American people. In such cases,
agencies shall identify and assess available alternatives to direct regulation, including
providing economic incentives to encourage the desired behavior, or providing information
upon which choices can be made by the private sector. These incentives, along with other
actions, shall be designed to help harness the latest technologies, bring about global
solutions to international problems, and enable private sector owners and operators to
achieve and maintain the maximum feasible security.
• The full authorities, capabilities and resources of the government, including law
179
enforcement, regulation, foreign intelligence and defense preparedness shall be available,
as appropriate, to ensure that critical infrastructure protection is achieved and maintained.
• Care must be taken to respect privacy rights. Consumers and operators must have
confidence that information will be handled accurately, confidentially and reliably. The
Federal Government shall, through its research, development and procurement, encourage
the introduction of increasingly capable methods of infrastructure protection.
• The Federal Government shall serve as a model to the private sector on how infrastructure
assurance is best achieved and shall, to the extent feasible, distribute the results of its
endeavors.
• We must focus on preventative measures as well as threat and crisis management. To that
end, private sector owners and operators should be encouraged to provide maximum
feasible security for the infrastructures they control and to provide the government
necessary information to assist them in that task. In order to engage the private sector fully,
it is preferred that participation by owners and operators in a national infrastructure
protection system be voluntary.
• Close cooperation and coordination with state and local governments and first responders is
essential for a robust and flexible infrastructure protection program. All critical infrastructure
protection plans and actions shall take into consideration the needs, activities and
responsibilities of state and local governments and first responders.
Structure and Organization
The Federal Government will be organized for the purposes of this endeavor around four
components (elaborated in Exhibit 1).
Exhibit 1: Structure and Organization
Lead Agencies:
Clear accountability within the U.S. Government must be designated for specific sectors and
functions. The following assignments of responsibility will apply:
Lead Agencies for Sector Liaison:
Commerce
Treasury
EPA
Transportation
Information and communications
Banking and finance
Water supply
Aviation
Highways (including trucking and intelligent transportation systems)
Mass transit
Pipelines
Rail
Justice/FBI
FEMA
Waterborne commerce
Emergency law enforcement services
Emergency fire service
180
HHS
Energy
Continuity of government services
Public health services, including prevention, surveillance, laboratory services and
personal health services
Electric power
Oil and gas production and storage
Lead Agencies for Special Functions:
Justice/FBI Law enforcement and internal security
CIA
Foreign intelligence
State
Foreign affairs
Defense
National defense
In addition, OSTP shall be responsible for coordinating research and development agendas and
programs for the government through the National Science and Technology Council. Furthermore,
while Commerce is the lead agency for information and communication, the Department of Defense
will retain its Executive Agent responsibilities for the National Communications System and support
of the President's National Security Telecommunications Advisory Committee.
National Coordinator:
The National Coordinator for Security, Infrastructure Protection and Counter−Terrorism shall be
responsible for coordinating the implementation of this directive. The National Coordinator will report
to the President through the Assistant to the President for National Security Affairs. The National
Coordinator will also participate as a full member of Deputies or Principals Committee meetings
when they meet to consider infrastructure issues. Although the National Coordinator will not direct
Departments and Agencies, he or she will ensure interagency coordination for policy development
and implementation, and will review crisis activities concerning infrastructure events with significant
foreign involvement. The National Coordinator will provide advice, in the context of the established
annual budget process, regarding agency budgets for critical infrastructure protection. The National
Coordinator will chair the Critical Infrastructure Coordination Group (CICG), reporting to the
Deputies Committee (or, at the call of its chair, the Principals Committee). The Sector Liaison
Officials and Special Function Coordinators shall attend the CICG's meetings. Departments and
agencies shall each appoint to the CICG a senior official (Assistant Secretary level or higher) who
will regularly attend its meetings. The National Security Advisor shall appoint a Senior Director for
Infrastructure Protection on the NSC staff.
A National Plan Coordination (NPC) staff will be contributed on a non−reimbursable basis by the
departments and agencies, consistent with law. The NPC staff will integrate the various sector plans
into a National Infrastructure Assurance Plan and coordinate analyses of the U.S. Government's
own dependencies on critical infrastructures. The NPC staff will also help coordinate a national
education and awareness program, and legislative and public affairs.
The Defense Department shall continue to serve as Executive Agent for the Commission Transition
Office, which will form the basis of the NPC, during the remainder of FY98. Beginning in FY99, the
NPC shall be an office of the Commerce Department. The Office of Personnel Management shall
provide the necessary assistance in facilitating the NPC's operations. The NPC will terminate at the
end of FY01, unless extended by Presidential directive.
Warning and Information Centers
181
As part of a national warning and information sharing system, the President immediately authorizes
the FBI to expand its current organization to a full scale National Infrastructure Protection Center
(NIPC). This organization shall serve as a national critical infrastructure threat assessment, warning,
vulnerability, and law enforcement investigation and response entity. During the initial period of six
to twelve months, the President also directs the National Coordinator and the Sector Liaison
Officials, working together with the Sector Coordinators, the Special Function Coordinators and
representatives from the National Economic Council, as appropriate, to consult with owners and
operators of the critical infrastructures to encourage the creation of a private sector sharing and
analysis center, as described below.
National Infrastructure Protection Center (NIPC)
The NIPC will include FBI, USSS, and other investigators experienced in computer crimes and
infrastructure protection, as well as representatives detailed from the Department of Defense, the
Intelligence Community and Lead Agencies. It will be linked electronically to the rest of the Federal
Government, including other warning and operations centers, as well as any private sector sharing
and analysis centers. Its mission will include providing timely warnings of intentional threats,
comprehensive analyses and law enforcement investigation and response. All executive
departments and agencies shall cooperate with the NIPC and provide such assistance, information
and advice that the NIPC may request, to the extent permitted by law.
All executive departments shall also share with the NIPC information about threats and warning of
attacks and about actual attacks on critical government and private sector infrastructures, to the
extent permitted by law. The NIPC will include elements responsible for warning, analysis, computer
investigation, coordinating emergency response, training, outreach, and development and
application of technical tools. In addition, it will establish its own relations directly with others in the
private sector and with any information sharing and analysis entity that the private sector may
create, such as the Information Sharing and Analysis Center described below.
The NIPC, in conjunction with the information originating agency, will sanitize law enforcement and
intelligence information for inclusion into analyses and reports that it will provide, in appropriate
form, to relevant federal, state and local agencies; the relevant owners and operators of critical
infrastructures; and to any private sector information sharing and analysis entity. Before
disseminating national security or other information that originated from the intelligence community,
the NIPC will coordinate fully with the intelligence community through existing procedures. Whether
as sanitized or unsanitized reports, the NIPC will issue attack warnings or alerts to increases in
threat condition to any private sector information sharing and analysis entity and to the owners and
operators. These warnings may also include guidance regarding additional protection measures to
be taken by owners and operators. Except in extreme emergencies, the NIPC shall coordinate with
the National Coordinator before issuing public warnings of imminent attacks by international
terrorists, foreign states or other malevolent foreign powers.
The NIPC will provide a national focal point for gathering information on threats to the
infrastructures. Additionally, the NIPC will provide the principal means of facilitating and
coordinating the Federal Government's response to an incident, mitigating attacks, investigating
threats and monitoring reconstitution efforts. Depending on the nature and level of a foreign
threat/attack, protocols established between special function agencies (DOJ/DOD/CIA), and the
ultimate decision of the President, the NIPC may be placed in a direct support role to either DOD or
the Intelligence Community.
Information Sharing and Analysis Center (ISAC):
182
The National Coordinator, working with Sector Coordinators, Sector Liaison Officials and the
National Economic Council, shall consult with owners and operators of the critical infrastructures to
strongly encourage the creation of a private sector information sharing and analysis center. The
actual design and functions of the center and its relation to the NIPC will be determined by the
private sector, in consultation with and with assistance from the Federal Government. Within 180
days of this directive, the National Coordinator, with the assistance of the CICG including the
National Economic Council, shall identify possible methods of providing federal assistance to
facilitate the startup of an ISAC.
Such a center could serve as the mechanism for gathering, analyzing, appropriately sanitizing and
disseminating private sector information to both industry and the NIPC. The center could also
gather, analyze and disseminate information from the NIPC for further distribution to the private
sector. While crucial to a successful government−industry partnership, this mechanism for sharing
important information about vulnerabilities, threats, intrusions and anomalies is not to interfere with
direct information exchanges between companies and the government. As ultimately designed by
private sector representatives, the ISAC may emulate particular aspects of such institutions as the
Centers for Disease Control and Prevention that have proved highly effective, particularly its
extensive interchanges with the private and non−federal sectors. Under such a model, the ISAC
would possess a large degree of technical focus and expertise and non−regulatory and non−law
enforcement missions. It would establish baseline statistics and patterns on the various
infrastructures, become a clearinghouse for information within and among the various sectors, and
provide a library for historical data to be used by the private sector and, as deemed appropriate by
the ISAC, by the government. Critical to the success of such an institution would be its timeliness,
accessibility, coordination, flexibility, utility and acceptability.
1. Lead Agencies for Sector Liaison: For each infrastructure sector that could be a target for
significant cyber or physical attacks, there will be a single U.S. Government department
which will serve as the lead agency for liaison. Each Lead Agency will designate one
individual of Assistant Secretary rank or higher to be the Sector Liaison Official for that area
and to cooperate with the private sector representatives (Sector Coordinators) in addressing
problems related to critical infrastructure protection and, in particular, in recommending
components of the National Infrastructure Assurance Plan. Together, the Lead Agency and
the private sector counterparts will develop and implement a Vulnerability Awareness and
Education Program for their sector.
2. Lead Agencies for Special Functions: There are, in addition, certain functions related to
critical infrastructure protection that must be chiefly performed by the Federal Government
(national defense, foreign affairs, intelligence, law enforcement). For each of those special
functions, there shall be a Lead Agency which will be responsible for coordinating all of the
activities of the United States Government in that area. Each lead agency will appoint a
senior officer of Assistant Secretary rank or higher to serve as the Functional Coordinator for
that function for the Federal Government.
3. Interagency Coordination: The Sector Liaison Officials and Functional Coordinators of the
Lead Agencies, as well as representatives from other relevant departments and agencies,
including the National Economic Council, will meet to coordinate the implementation of this
directive under the auspices of a Critical Infrastructure Coordination Group (CICG), chaired
by the National Coordinator for Security, Infrastructure Protection and Counter−Terrorism.
The National Coordinator will be appointed by and report to the President through the
Assistant to the President for National Security Affairs, who shall assure appropriate
183
coordination with the Assistant to the President for Economic Affairs. Agency
representatives to the CICG should be at a senior policy level (Assistant Secretary or
higher). Where appropriate, the CICG will be assisted by extant policy structures, such as
the Security Policy Board, Security Policy Forum and the National Security and
Telecommunications and Information System Security Committee.
4. National Infrastructure Assurance Council: On the recommendation of the Lead Agencies,
the National Economic Council and the National Coordinator, the President will appoint a
panel of major infrastructure providers and state and local government officials to serve as
the National Infrastructure Assurance Council. The President will appoint the Chairman. The
National Coordinator will serve as the Council's Executive Director. The National
Infrastructure Assurance Council will meet periodically to enhance the partnership of the
public and private sectors in protecting our critical infrastructures and will provide reports to
the President as appropriate. Senior Federal Government officials will participate in the
meetings of the National Infrastructure Assurance Council as appropriate.
Protecting Federal Government Critical Infrastructures
Every department and agency of the Federal Government shall be responsible for protecting its own
critical infrastructure, especially its cyber−based systems. Every department and agency Chief
Information Officer (CIO) shall be responsible for information assurance. Every department and
agency shall appoint a Chief Infrastructure Assurance Officer (CIAO) who shall be responsible for
the protection of all of the other aspects of that department's critical infrastructure. The CIO may be
double−hatted as the CIAO at the discretion of the individual department. These officials shall
establish procedures for obtaining expedient and valid authorizations to allow vulnerability
assessments to be performed on government computer and physical systems. The Department of
Justice shall establish legal guidelines for providing for such authorizations.
No later than 180 days from issuance of this directive, every department and agency shall develop a
plan for protecting its own critical infrastructure, including but not limited to its cyber−based systems.
The National Coordinator shall be responsible for coordinating analyses required by the
departments and agencies of inter−governmental dependencies and the mitigation of those
dependencies. The Critical Infrastructure Coordination Group (CICG) shall sponsor an expert review
process for those plans. No later than two years from today, those plans shall have been
implemented and shall be updated every two years. In meeting this schedule, the Federal
Government shall present a model to the private sector on how best to protect critical infrastructure.
Tasks
Within 180 days, the Principals Committee should submit to the President a schedule for completion
of a National Infrastructure Assurance Plan with milestones for accomplishing the following
subordinate and related tasks.
1. Vulnerability Analyses: For each sector of the economy and each sector of the government
that might be a target of infrastructure attack intended to significantly damage the United
States, there shall be an initial vulnerability assessment, followed by periodic updates. As
appropriate, these assessments shall also include the determination of the minimum
essential infrastructure in each sector.
2. Remedial Plan: Based upon the vulnerability assessment, there shall be a recommended
remedial plan. The plan shall identify time lines for implementation, responsibilities and
funding.
3. Warning: A national center to warn of significant infrastructure attacks will be established
immediately (see Exhibit 1). As soon thereafter as possible, we will put in place an enhanced
184
system for detecting and analyzing such attacks, with maximum possible participation of the
private sector.
4. Response: A system for responding to a significant infrastructure attack while it is underway,
with the goal of isolating and minimizing damage.
5. Reconstitution: For varying levels of successful infrastructure attacks, we shall have a
system to reconstitute minimum required capabilities rapidly.
6. Education and Awareness: There shall be Vulnerability Awareness and Education Programs
within both the government and the private sector to sensitize people regarding the
importance of security and to train them in security standards, particularly regarding cyber
systems.
7. Research and Development: Federally−sponsored research and development in support of
infrastructure protection shall be coordinated, be subject to multi−year planning, take into
account private sector research, and be adequately funded to minimize our vulnerabilities on
a rapid but achievable timetable.
8. Intelligence: The Intelligence Community shall develop and implement a plan for enhancing
collection and analysis of the foreign threat to our national infrastructure, to include but not
be limited to the foreign cyber/information warfare threat.
9. International Cooperation: There shall be a plan to expand cooperation on critical
infrastructure protection with like−minded and friendly nations, international organizations
and multinational corporations.
10. Legislative and Budgetary Requirements: There shall be an evaluation of the executive
branch's legislative authorities and budgetary priorities regarding critical infrastructure, and
ameliorative recommendations shall be made to the President as necessary. The
evaluations and recommendations, if any, shall be coordinated with the Director of OMB.
The CICG shall also review and schedule the taskings listed in Exhibit 2.
Exhibit 2: Additional Taskings
Studies
The National Coordinator shall commission studies on the following subjects:
• Liability issues arising from participation by private sector companies in the information
sharing process.
• Existing legal impediments to information sharing, with an eye to proposals to remove these
impediments, including through the drafting of model codes in cooperation with the American
Legal Institute.
• The necessity of document and information classification and the impact of such
classification on useful dissemination, as well as the methods and information systems by
which threat and vulnerability information can be shared securely while avoiding disclosure
or unacceptable risk of disclosure to those who will misuse it.
• The improved protection, including secure dissemination and information handling systems,
of industry trade secrets and other confidential business data, law enforcement information
and evidentiary material, classified national security information, unclassified material
disclosing vulnerabilities of privately owned infrastructures and apparently innocuous
information that, in the aggregate, it is unwise to disclose.
• The implications of sharing information with foreign entities where such sharing is deemed
necessary to the security of United States infrastructures.
• The potential benefit to security standards of mandating, subsidizing, or otherwise assisting
in the provision of insurance for selected critical infrastructure providers and requiring
insurance tie−ins for foreign critical infrastructure providers hoping to do business with the
185
United States.
Public Outreach
In order to foster a climate of enhanced public sensitivity to the problem of infrastructure protection,
the following actions shall be taken:
• The White House, under the oversight of the National Coordinator, together with the relevant
Cabinet agencies shall consider a series of conferences: (1) that will bring together national
leaders in the public and private sectors to propose programs to increase the commitment to
information security; (2) that convoke academic leaders from engineering, computer science,
business and law schools to review the status of education in information security and will
identify changes in the curricula and resources necessary to meet the national demand for
professionals in this field; (3) on the issues around computer ethics as these relate to the K
through 12 and general university populations.
• The National Academy of Sciences and the National Academy of Engineering shall consider
a round table bringing together federal, state and local officials with industry and academic
leaders to develop national strategies for enhancing infrastructure security.
• The intelligence community and law enforcement shall expand existing programs for briefing
infrastructure owners and operators and senior government officials.
• The National Coordinator shall (1) establish a program for infrastructure assurance
simulations involving senior public and private officials, the reports of which might be
distributed as part of an awareness campaign; and (2) in coordination with the private sector,
launch a continuing national awareness campaign, emphasizing improving infrastructure
security.
Internal Federal Government Actions
In order for the Federal Government to improve its infrastructure security, these immediate steps
shall be taken:
• The Department of Commerce, the General Services Administration, and the Department of
Defense shall assist federal agencies in the implementation of best practices for information
assurance within their individual agencies.
• The National Coordinator shall coordinate a review of existing federal, state and local bodies
charged with information assurance tasks, and provide recommendations on how these
institutions can cooperate most effectively.
• All federal agencies shall make clear designations regarding who may authorize access to
their computer systems.
• The Intelligence Community shall elevate and formalize the priority for enhanced collection
and analysis of information on the foreign cyber/information warfare threat to our critical
infrastructure.
• The Federal Bureau of Investigation, the Secret Service and other appropriate agencies
shall: (1) vigorously recruit undergraduate and graduate students with the relevant
computer−related technical skills for full−time employment as well as for part−time work with
regional computer crime squads; and (2) facilitate the hiring and retention of qualified
personnel for technical analysis and investigation involving cyber attacks.
• The Department of Transportation, in consultation with the Department of Defense, shall
undertake a thorough evaluation of the vulnerability of the national transportation
infrastructure that relies on the Global Positioning System. This evaluation shall include
sponsoring an independent, integrated assessment of risks to civilian users of GPS−based
systems, with a view to basing decisions on the ultimate architecture of the modernized NAS
186
on these evaluations.
• The Federal Aviation Administration shall develop and implement a comprehensive National
Airspace System Security Program to protect the modernized NAS from information−based
and other disruptions and attacks.
• GSA shall identify large procurements (such as the new Federal Telecommunications
System, FTS 2000) related to infrastructure assurance, study whether the procurement
process reflects the importance of infrastructure protection and propose, if necessary,
revisions to the overall procurement process to do so.
• OMB shall direct federal agencies to include assigned infrastructure assurance functions
within their Government Performance and Results Act strategic planning and performance
measurement framework.
• The NSA, in accordance with its National Manager responsibilities in NSD−42, shall provide
assessments encompassing examinations of U.S. Government systems to interception and
exploitation; disseminate threat and vulnerability information; establish standards; conduct
research and development; and conduct issue security product evaluations.
Assisting the Private Sector
In order to assist the private sector in achieving and maintaining infrastructure security:
• The National Coordinator and the National Infrastructure Assurance Council shall propose
and develop ways to encourage private industry to perform periodic risk assessments of
critical processes, including information and telecommunications systems.
• The Department of Commerce and the Department of Defense shall work together, in
coordination with the private sector, to offer their expertise to private owners and operators
of critical infrastructure to develop security−related best practice standards.
• The Department of Justice and Department of the Treasury shall sponsor a comprehensive
study compiling demographics of computer crime, comparing state approaches to computer
crime and developing ways of deterring and responding to computer crime by juveniles.
Implementation
In addition to the 180−day report, the National Coordinator, working with the National Economic
Council, shall provide an annual report on the implementation of this directive to the President and
the heads of departments and agencies, through the Assistant to the President for National Security
Affairs. The report should include an updated threat assessment, a status report on achieving the
milestones identified for the National Plan and additional policy, legislative and budgetary
recommendations. The evaluations and recommendations, if any, shall be coordinated with the
Director of OMB. In addition, following the establishment of an initial operating capability in the year
2000, the National Coordinator shall conduct a zero−based review.
Foreign Ownership Interests in the American Communications
Infrastructure
On September 7, 2000, Kevin V. DiGregory, Deputy Assistant Attorney General, Department of
Justice, testified before the House Subcommittee on Telecommunications, Trade, and Consumer
Protection, Committee on Commerce, about foreign ownership interests and foreign government
ownership interests in the American communications infrastructure. His statement discusses the
various policy and law enforcement implications that arise from this issue. This statement can be
187
viewed at www.doj.gov/criminal/cybercrime/kvd_telecom.htm
On September 7, 2000, Larry R. Parkinson, General Counsel for the Federal Bureau of
Investigation, testified before the House Subcommittee on Telecommunications, Trade, and
Consumer Protection, Committee on Commerce, about foreign government ownership of American
telecommunications companies. His statement discusses the various policy and law enforcement
implications that arise from this issue. This statement can be viewed at
www.usdoj.gov/criminal/cybercrime/lrp_telecom.htm
Carnivore and the Fourth Amendment
Statement of Kevin V. DiGregory, Deputy Assistant Attorney General, United States Department of
Justice, July 24, 2000
Subcommittee on the Constitution of the House Committee on the Judiciary
Mr. Chairman and Members of the Subcommittee, thank you for allowing me this opportunity to
testify about the law enforcement tool "Carnivore" and the Fourth Amendment. On April 6, 2000, I
had the privilege of testifying before you during a hearing on Internet privacy and the Fourth
Amendment; I am pleased to continue to participate in the discussion today about "Carnivore" and
its role in protecting individual privacy on the Internet from unwarranted governmental intrusion, and
about the critical role the Department plays to ensure that the Internet is a safe and secure place.
Privacy and Public Safety
It is beyond dispute that the Fourth Amendment protects the rights of Americans while they work
and play on the Internet just as it does in the physical world. The goal is a long−honored and noble
one: to preserve our privacy while protecting the safety of our citizens. Our founding fathers
recognized that in order for our democratic society to remain safe and our liberty intact, law
enforcement must have the ability to investigate, apprehend and prosecute people for criminal
conduct. At the same time, however, our founding fathers held in disdain the government's
disregard and abuse of privacy in England. The founders of this nation adopted the Fourth
Amendment to address the tension that can at times arise between privacy and public safety. Under
the Fourth Amendment, the government must demonstrate probable cause before obtaining a
warrant for a search, arrest, or other significant intrusion on privacy.
Congress and the courts have also recognized that lesser intrusions on privacy should be permitted
under a less exacting threshold. The Electronic Communications Privacy Act ("ECPA") establishes
a three−tier system by which the government can obtain stored information from electronic
communication service providers. In general, the government needs a search warrant to obtain the
content of unretrieved communications (like e−mail), a court order to obtain transactional records,
and a subpoena to obtain information identifying the subscriber. See 18 U.S.C. §§ 2701−11.
In addition, in order to obtain source and destination information in real time, the government must
obtain a "trap and trace" or "pen register" court order authorizing the recording of such information.
See 18 U.S.C. 3121, et seq.
Because of the privacy values it protects, the wiretap statute, 18 U.S.C. §§ 2510−22, commonly
known as Title III, places a higher burden on the real−time interception of oral, wire and electronic
communications than the Fourth Amendment requires. In the absence of a statutory exception, the
government needs a court order to wiretap communications. To obtain such an order, the
188
government must show that normal investigative techniques for obtaining the information have or
are likely to fail or are too dangerous, and that any interception will be conducted so as to ensure
that the intrusion is minimized.
The safeguards for privacy represented by the Fourth Amendment and statutory restrictions on
government access to information do not prevent effective law enforcement. Instead, they provide
boundaries for law enforcement, clarifying what is acceptable evidence gathering and what is not. At
the same time, those who care deeply about protecting individual privacy must also acknowledge
that law enforcement has a critical role to play in preserving privacy. When law enforcement
investigates, successfully apprehends and prosecutes a criminal who has stolen a citizen's personal
information from a computer system, for example, law enforcement is undeniably working to protect
privacy and deter further privacy violations. The same is true when law enforcement apprehends a
hacker who compromised the financial records of a bank customer.
As we move into the 21st century, we must ensure that the needs of privacy and public safety
remain in balance and are appropriately reflected in the new and emerging technologies that are
changing the face of communications. Although the primary mission of the Department of Justice is
law enforcement, Attorney General Reno and the entire Department understand and share the
legitimate concerns of all Americans with regard to personal privacy. The Department has been and
will remain committed to protecting the privacy rights of individuals. We look forward to working with
Congress and other concerned individuals to address these important matters in the months ahead.
Law Enforcement Tools in Cyberspace
Although the Fourth Amendment is over two centuries old, the Internet as we know it is still in its
infancy. The huge advances in the past ten years have changed forever the landscape of society,
not just in America, but worldwide. The Internet has resulted in new and exciting ways for people to
communicate, transfer information, engage in commerce, and expand their educational
opportunities. These are but a few of the wonderful benefits of this rapidly changing technology. As
has been the case with every major technological advance in our history, however, we are seeing
individuals and groups use this technology to commit criminal acts. As Deputy Attorney General Eric
Holder told the Crime Subcommittee of this Committee in February, our vulnerability to computer
crime is astonishingly high and threatens not only our financial well−being and our privacy, but also
this nation's critical infrastructure.
Many of the crimes that we confront everyday in the physical world are beginning to appear in the
online world. Crimes like threats, extortion, fraud, identity theft, and child pornography are migrating
to the Internet. The Fourth Amendment and laws addressing privacy and public safety serve as a
framework for law enforcement to respond to this new forum for criminal activity. If law enforcement
fails properly to respect individual privacy in its investigative techniques, the public's confidence in
government will be eroded, evidence will be suppressed, and criminals will elude successful
prosecution. If law enforcement is too timid in responding to cybercrime, however, we will, in effect,
render cyberspace a safe haven for criminals and terrorists to communicate and carry out crime,
without fear of authorized government surveillance. If we fail to make the Internet safe, people's
confidence in using the Internet and e−commerce will decline, endangering the very benefits
brought by the Information Age. Proper balance is the key.
To satisfy our obligations to the public to enforce the laws and preserve the safety, we use the same
sorts of investigative techniques and methods online as we do in the physical world, with the same
careful attention to the strict constitutional, statutory, internal and court−ordered boundaries.
Carnivore is simply an investigative tool that is used online only under narrowly defined
circumstances, and only when authorized by law, to meet our responsibilities to the public.
189
To illustrate, law enforcement often needs to find out from whom a drug dealer, for example, is
buying his illegal products, or to whom the drug dealer is selling. To investigate this, it is helpful to
determine who is communicating with the drug dealer. In the "olden days" of perhaps 10 years ago,
the drug dealer would have communicated with his supplier and customers exclusively through use
of telephones and pagers. Law enforcement would obtain an order from a court authorizing the
installation of a "trap and trace" and a "pen register" device on the drug dealer's phone or pager,
and either the telephone company or law enforcement would have installed these devices to comply
with the court's order. Thereafter, the source and destination of his phone calls would have been
recorded. This is information that courts have held is not protected by any reasonable expectation of
privacy. Given the personal nature of this information, however, the law requires government to
obtain an order under these circumstances. In this way, privacy is protected and law enforcement is
able to investigate to protect the public.
Now, that same drug dealer may be just as likely to send an e−mail as call his confederates. When
law enforcement uses a "trap and trace" or "pen register" in the online context, however, we have
found that, at times, the Internet service provider has been unable or even unwilling to supply this
information. Law enforcement cannot abdicate its responsibility to protect public safety simply
because technology has changed. Rather, the public rightfully expects that law enforcement will
continue to be effective as criminal activity migrates to the Internet. We cannot do this without tools
like Carnivore.
When a criminal uses e−mail to send a kidnapping demand, to buy and sell illegal drugs or to
distribute child pornography, law enforcement needs to know to whom he is sending messages and
from whom he receives them. To get this information, we obtain a court order, which we serve on
the appropriate service provider. Because of the nature of Internet communications, the addressing
information (which does not include the content of the message) is often mixed in with a lot of other
non−content data that we have no desire to gather. If the service provider can comply with the order
and provide us with only the addressing information required by court order, it will do so and we will
not employ Carnivore. If, however, the service provider is unwilling or unable to comply with the
order, we simply cannot give a criminal a free pass. It is for that narrow set of circumstances that
the FBI designed "Carnivore."
Carnivore is, in essence, a special filtering tool that can gather the information authorized by court
order, and only that information. It permits law enforcement, for example, to gather only the e−mail
addresses of those persons with whom the drug dealer is communicating, without allowing any
human being, either from law enforcement or the service provider, to view private information
outside of the scope of the court's order. In other words, Carnivore is a minimization tool that
permits law enforcement strictly to comply with court orders, strongly to protect privacy, and
effectively to enforce the law to protect the public interest. In addition, Carnivore creates an audit
trail that demonstrates exactly what it is capturing.
As with any other investigative tools, there are many mechanisms we have in place to prevent
against possible misuse of Carnivore, and to remedy misuse that has occurred. The Fourth
Amendment, of course, restricts what law enforcement can do with Carnivore, as do the statutory
requirements of Title III and the Electronic Communications Privacy Act, and the courts.
For federal Title III applications, the Department of Justice imposes its own guidelines on top of the
privacy protections provided by the Constitution, statutes and the courts. For example, before
Carnivore may be used to intercept wire or electronic communications, the requesting investigative
agency must obtain approval for the Title III application from the Department of Justice. Specifically,
the Office of Enforcement Operations (OEO) in the Criminal Division of the Department reviews
each proposed Title III application to ensure that the interception satisfies the Fourth Amendment
190
requirements, and is in compliance with applicable statutes and regulations. Even if the proposal
clears the OEO, approval must be given by a Deputy Assistant Attorney General. Although this
requirement of high−level review is required by Title III only with regard to proposed intercepts of
wire and oral communications, the Department voluntarily imposes the same level of review for
proposed interceptions of electronic communications (except digital−display pagers). Typically,
investigative agencies such as the Federal Bureau of Investigation have similar internal
requirements, separate and apart from Constitutional, statutory or Department of Justice
requirements.
If the investigative agency and the Department of Justice approve a federal Title III request, it still
must, of course, be approved by the proper court. The court will evaluate the application under the
Fourth Amendment and using the familiar standards of Title III. By statute, for example, the
application to the court must show, through sworn affidavit, why the intercept is necessary as
opposed to other less−intrusive investigative techniques. The application must also provide
additional detail, including whether there have been previous interceptions of communications of the
target, the identity of the target (if known), the nature and location of the communications facilities,
and a description of the type of communications sought and the offenses to which the
communications relate. By statute and internal Department regulation, the interception may last no
longer than 30 days without an extension by the court.
Courts also often impose their own requirements. For example, many federal courts require that the
investigators provide periodic reports setting forth information such as the number of
communications intercepted, steps taken to minimize irrelevant traffic, and whether the interceptions
have been fruitful. The court may, of course terminate the interception at any time.
The remedies for violating Title III or ECPA by improperly intercepting electronic communications
can include criminal sanctions, civil suit, and for law enforcement agents, adverse employment
action. For violations of the Fourth Amendment, of course, the remedy of suppression is also
available.
Carnivore itself also contains self−regulating features. For example, because of its sophisticated
passive filtering features, it automates the process of minimization without intrusive monitoring by
investigators, and simply disregards packets of information that do not satisfy the criteria in the
court's authorization. Indeed, one of the most powerful privacy−protecting features of Carnivore is
its ability to ignore information that is outside the scope of the court−ordered authority. For later
verification, it also logs the filter settings. In addition, as a practical matter, Carnivore is not deployed
except with close cooperation with the appropriate system provider. In any event, the FBI does not
use Carnivore in every instance in which the court orders a Title III electronic communication
intercept. Indeed, I understand that the Bureau uses Carnivore only in those instances when the
service provider is unable to comply with the court order using its own equipment, or when the
provider asks the FBI to use Bureau equipment.
As I testified in April, we face three major categories of challenges in trying to keep the Internet a
safe and secure place for our citizens. These are:
1. Technical challenges that hamper law enforcement's ability to locate and prosecute criminals
that operate online;
2. Certain substantive and procedural laws that have not kept pace with the changing
technology, creating significant legal challenges to effective investigation and prosecution of
crime in cyberspace; and
3. Resource needs that must be addressed to ensure that law enforcement can keep pace with
changing technology and has the ability to hire and train people to fight cybercrime.
191
Carnivore is an investigative tool that assists us in meeting the first challenge. As we have
witnessed, tracking a criminal online is not always an impossible task using our investigative tools.
For example, last year federal and state law enforcement combined to successfully apprehend the
creator of the Melissa virus and the individual who created a fraudulent Bloomberg News Service
Web site in order to artificially drive up the stock price of PairGain, a telecommunications company
based in California. Although we are proud of these important successes, we still face significant
challenges as online criminals become more and more sophisticated.
In nearly every online case, tracking the online criminal requires law enforcement to attempt to trace
the "electronic trail" from the victim back to the perpetrator. In effect, this "electronic trail" is the
fingerprint of the twenty−first century — only much harder to find and not as permanent as its more
traditional predecessor. In the physical world, a criminal and his victim are generally in the same
location. But cybercriminals do not have to physically visit the crime scene. Instead they cloak their
illegal activity by weaving communications through a series of anonymous remailers, by creating
forged e−mail headers with powerful point and click tools readily downloadable from hacker Web
sites, by using a "free−trial" account or two, or by "wiping clean" the logging records that would be
evidence of their activity.
In some cases, the criminal may not even be in the same country as the victim. The global nature of
the Internet, while one of the greatest assets of the Internet to law−abiding citizens, allows criminals
to conduct their illegal activity from across the globe. In these cases, the need to respond quickly
and track the criminal is increasingly complicated and often frustrated by the fact that the activity
takes place throughout different countries. With more than 190 countries connected to the Internet,
it is easy to understand the coordination challenges that face law enforcement. Furthermore, in
these cases, time is of the essence and the victim may not even realize they have been victimized
until the criminal has long since signed−off. Clearly, the technical challenges for law enforcement
are real and profound.
This fact was made clear in the findings and conclusions reached in the recently released report of
the President's Working Group on Unlawful Conduct on the Internet, entitled, "The Electronic
Frontier: The Challenge of Unlawful Conduct Involving the Use of the Internet." This extensive
report highlights in detail the significant challenges facing law enforcement in cyberspace. As the
report states, the needs and challenges confronting law enforcement, "are neither trivial nor
theoretical." The Report outlines a three−pronged approach for responding to unlawful activity on
the Internet:
1. Conduct on the Internet should be treated in the same manner as similar conduct offline, in a
technology neutral manner.
2. We must recognize that the needs and challenges of law enforcement posed by the Internet
are substantial, including our need for resources, up−to date investigative tools and
enhanced multi−jurisdictional cooperation.
3. Finally, we need to foster continued support for private sector leadership in developing tools
and methods to help Internet users to prevent and minimize the risks of unlawful conduct
online.
I would encourage anyone with an interest in this important topic to review carefully the report of the
Working Group. The report can be found on the Internet by visiting the Web site of the Department
of Justice's Computer Crime and Intellectual Property Section, located at
http://www.cybercrime.gov/. In addition to the report, http://www.cybercrime.gov/ also contains other
useful information on a wide array of Internet related issues, including the topic of today's hearing —
privacy.
192
Despite the type of difficulties outlined in the Unlawful Conduct Report and discussed today, the
Justice Department and law enforcement across this nation are committed to continuing to work
together and with their counterparts in other countries to develop and implement investigative
strategies to successfully track, apprehend, and prosecute individuals who conduct criminal activity
on the Internet. In so doing, the same privacy standards that apply in the physical world remain
effective online.
Mr. Chairman, the Department of Justice has taken a proactive leadership role in making
cyberspace safer for all Americans. The cornerstone of our cybercrime prosecutor program is the
Criminal Division's Computer Crime and Intellectual Property Section, known as CCIPS. CCIPS was
founded in 1991 as the Computer Crime Unit, and became a Section in 1996. CCIPS has grown
from five attorneys in 1996 to nineteen today, and we need more to keep pace with the demand for
their expertise. The attorneys in CCIPS work closely on computer crime cases with Assistant United
States Attorneys known as "Computer and Telecommunications Coordinators," or CTC's, in U.S.
Attorney's Offices around the nation. Each CTC receives special training and equipment and serves
as the district's expert on computer crime cases. CCIPS and the CTC's work together in prosecuting
cases, spearheading training for local, state and federal law enforcement, working with international
counterparts to address difficult international challenges, and providing legal and technical
instruction to assist in the protection of this nation's critical infrastructures. We are very proud of the
work these people do and we will continue to work diligently to help stop criminals from victimizing
people online.
I also note that public education is an important component of the Attorney General's strategy on
combating computer crime. As she often notes, the same children who recognize that it is wrong to
steal a neighbor's mail or shoplift do not seem to understand that it is equally wrong to steal a
neighbor's e−mail or copy a proprietary software or music file without paying for it. To remedy this
problem, the Department of Justice, together with the Information Technology Association of
America (ITAA), has embarked upon a national campaign to educate and raise awareness of
computer responsibility and to provide resources to empower concerned citizens. The "Cybercitizen
Awareness Program" seeks to engage children, young adults, and others on the basics of critical
information protection and security and on the limits of acceptable online behavior. The objectives of
the program are to give children an understanding of cyberspace benefits and responsibilities, an
awareness of consequences resulting from the misuse of the medium and an understanding of the
personal dangers that exist on the Internet and techniques to avoid being harmed.
Finally, Mr. Chairman, the Subcommittee may be aware that the Administration will soon be
transmitting to Congress a legislative proposal addressing various issues relating to cyber−security.
I know that the focus of today's hearing is the Carnivore program, and this is not the time to
undertake any detailed discussion of the Administration's proposal. I would, however, like to
mention two points that relate directly to today's discussion. First, the Administration supports
raising the statutory standards for intercepting the content of electronic communications so they are
the same as those for intercepting telephone calls: high−level approval, use only in cases involving
certain predicate offenses that are specified by statute, and statutory suppression of evidence
derived from improper intercepts. Second, the Administration supports requiring federal judges to
confirm that the appropriate statutory predicates have been satisfied before issuing a pen register or
trap−and−trace order. Those changes would apply to the use of Carnivore — and would, in
important respects, simply confirm by statute the policies and procedures already followed by the
Department of Justice. Beyond those specific points, I will simply note here that the Administration
supports a balanced updating of laws to enhance protection of both privacy and public safety, and
that the forthcoming proposal will contain important provisions whose enactment would be most
helpful in the ongoing fight against cyber−crime.
193
Conclusion
Mr. Chairman, I want to thank you again for this opportunity to testify today about our efforts to fight
crime on the Internet while preserving the rights conferred by the Fourth Amendment and statute.
Ultimately, the decision as to the appropriate parameters of law enforcement activity lies squarely
within the Constitution and the elected representatives of the people, the Congress. The need to
protect the privacy of the American people, not just from the government but also from criminals, is
a paramount consideration, not just in the context of the Internet, but in general. The Department of
Justice stands ready to work with this Subcommittee and others to achieve the proper balance
between the important need for protecting privacy and the need to respond to the growing threat of
crime in cyberspace.
Mr. Chairman, that concludes my prepared statement. I would be pleased to attempt to answer any
questions that you may have at this time.
194
Chapter 13: Electronic Commerce: Legal Issues
Overview
The Electronic Commerce Working Group (ECWG), Department of Justice
The Electronic Commerce Working Group (ECWG) of the Department of Justice consists of lawyers
from throughout the Department who are in regular contact to discuss legal issues related to
electronic commerce. The ECWG provides a convenient vehicle for Justice Department attorneys to
disseminate information quickly regarding electronic commerce developments.
The ECWG has studied complex and novel legal issues, and helps to coordinate Justice
Department positions on emerging legal issues. For example, the ECWG has a sub−group that
meets regularly to study legal issues related to electronic filing and electronic transactions;
representatives of this sub−group have met with representatives of other federal agencies to
discuss these issues in the context of a particular agency's processes.
For more information about the Department of Justice's Electronic Commerce Working Group,
please call the Department of Justice's Computer Crime and Intellectual Property Section at
202−514−1026.
Guide for Federal Agencies on Implementing Electronic
Processes
This guide addresses legal issues that agencies are likely to face in converting to electronic
processes and provides suggestions on how to address these issues. The rise of electronic
commerce offers departments and agencies exciting opportunities to convert or redesign existing
processes. At the same time, creating a more accessible and efficient government requires us to
maintain public confidence in the security and reliability of the Government's electronic transactions,
processes, and systems. Thus, in designing electronic systems, departments and agencies should
ensure that essential data are available when need[ed] and that the data and the underlying
processes are legally sufficient, reliable and in compliance with all applicable legal requirements.
Attorney General Reno's Cover Memorandum to the Guide (November 22, 2000)
Office of the Attorney General
Washington, D.C. 20530
November 22, 2000
Memorandum for the Heads of Departments and Agencies
From: The Attorney General
Subject: Guidance on Legal Considerations Related to the Government Paperwork
Elimination Act
Under the Government Paperwork Elimination Act (GPEA), Pub. L. No. 105−277. §§1701−1710
(1998) (codified as 44 U.S.C.A. §3504 n. (West Supp. 1999)), executive agencies are required, by
October 21, 2003, to provide "for the option of the electronic maintenance, submission, or disclosure
of information, when practicable as a substitute for paper" and "for the use and acceptance of
electronic signatures, when practicable." (GPEA §1704.) To assist agencies implementing GPRA,
195
the Office of Management and Budget (OMB) has developed Procedures and Guidance on
Implementing the Government Paperwork Elimination Act (OMB Guidance). 65 Fed. Reg. 25,511
(May 2, 2000). Under the OMB Guidance, the Department of Justice is charged with developing, in
consultation with federal agencies and OMB, practical guidance on legal considerations related to
agency use of electronic filing and record keeping. 65 Fed. Reg. at 25,513.
I am enclosing a copy of the Department's guidance, entitled "Legal Considerations in Designing
and Implementing Electronic Processes: A Guide for Federal Agencies" (the Guide). The Guide,
which was prepared in consultation with OMB and other federal agencies, addresses legal issues
that agencies are likely to face in converting to electronic processes and provides suggestions on
how to address these issues.
The rise of electronic commerce offers departments and agencies exciting opportunities to convert
or redesign existing processes. GPEA is an important tool in assisting departments and agencies in
improving customer service and government efficiency through the use of information technology.
At the same time, creating a more accessible and efficient government requires us to maintain
public confidence in the security and reliability of the Government's electronic transactions,
processes, and systems. Thus, in designing electronic sytems, departments and agencies should
ensure that essential data are available when needed and that the data and the underlying
processes are legally sufficient, reliable, and in compliance with all applicable legal requirements.
This Guide was prepared to assist your department or agency in protecting its legal rights and
minimizing the leqal risks as you develop and implement electronic−based processes and
transactions. The Guide also includes the names of attorneys at the Department of Justice who may
be contacted if your department or agency has additional questions.
I hope you find the Guide useful, and I look forward to our continued work together in using
information technology to make our Government processes and transactions more efficient, secure,
reliable, and responsive to the needs of the American people.
Guide to the Federal Agencies on Implementing Electronic Processes
November 2000
Reference Appendix 43
Consumer Protection in the Global Electronic Marketplace
The Justice Department submitted comments to the Federal Trade Commission on the subject of
"Consumer Protection in the Global Electronic Marketplace." The Justice Department submitted
these comments on March 29, 1999. The full text of the Justice Department comments is available
at www.usdoj.gov/criminal/cybercrime/ftcconsu.htm
The Government Paperwork Elimination Act
The Justice Department submitted comments to the Office of Management and Budget on the
Proposed Procedures and Guidance on Implementing the Government Paperwork Elimination Act.
The OMB's proposal was published at 64 Fed. Reg. 10.896 (March 5, 1999). The Justice
Department filed these comments on June 25, 1999. The full text of the Justice Department
comments, including the cover letter from Associate Attorney General Raymond Fisher is available
via the link below:
196
• http://www.cybercrime.gov/gpea.htm
Internet Gambling
1. Federal Legislation Related to Internet Gambling
Kevin V. DiGregory, Deputy Assistant Attorney General, testified before the House of
Representatives Committee on Banking and Financial Services on June 20, 2000, on Gambling on
the Internet. As with earlier testimony, this statement addressed the Department of Justice's
concerns with proposed Internet gambling legislation and the problems inherent in creating a
solution that is not technology−neutral. [http://www.cybercrime.gov/kvd0600.htm]
Questions and Answers
• How can the Department prosecute Internet gambling under existing law?
• How would new legislation prohibiting Internet gaming affect Indian tribes?
• Give us more details about the cases in the Southern District of New York?
• How would pending legislation affect fantasy sports leagues conducted on the Internet?
• What have other countries done with regard to Internet gaming?
2. Prosecution of Internet Gambling
On February 28, 2000, Jay Cohen was convicted in Manhattan federal court of operating a sports
betting business that illegally accepted bets and wagers on sporting events from Americans over
the Internet and telephones. Cohen is the first defendant to stand trial in a series of Internet offshore
sports gambling cases that were the first prosecutions brought under the federal Wire Wager Act.
Sentencing is scheduled for May 23, 2000.
Jay Cohen Convicted of Operating an Off−Shore Sports Betting Business that Accepted Bets from
Americans Over the Internet (February 28, 2000). The statement can be found at
www.usdoj.gov/criminal/cybercrime/cohen.htm.
In New York, twenty−one owners, managers and employees of Internet sports betting companies
have been charged in Manhattan federal court with conspiracy to transmit bets and wagers on
sporting events via the Internet and telephones. Information about the filing of these charges is
available below.
Owners, Managers and Employees of Internet Sports Betting Companies Charged with Violating
Federal Law The statement can be found at www.usdoj.gov/criminal/cybercrime/nypr.htm.
Sale of Prescription Drugs Over the Internet
On October 25, 2000, a New Jersey man pleaded guilty to one count of fraud. The man, Stanley
Lapides, admitted to selling via the Internet home HIV test kits. However, Lapides neglected to tell
his customers that these kits had not yet been approved for use by the FDA. The statement can be
found at www.usdoj.gov/criminal/cybercrime/hivtest.htm.
On May 25, 2000, Deputy Associate Attorney General Ethan M. Posner testified before the
Subcommittee on Oversight and Investigations of the House Committee on Commerce on the
subject of Online Pharmaceutical Drug Sales. His testimony detailed the role of the Department of
197
Justice in Internet drug sales, including current specific efforts by the Department and information
on the Internet Prescription Drug Sales Act of 2000. The statement can be found at
www.usdoj.gov/criminal/cybercrime/posner.htm.
On December 9, 1999, a federal grand jury charged Kent Aoki Lee with selling Viagra over the
Internet without a prescription. Lee was also charged with wire fraud and trademark violations
growing out of his operation of a separate pirated Internet Web site. The statement can be found at
www.usdoj.gov/criminal/cybercrime/kaokilee.htm.
Ivan K. Fong, Deputy Associate Attorney General, Department of Justice, testified before the
Subcommittee on Oversight and Investigations, Committee of Commerce of the United States
House of Representatives regarding Sale of Prescription Drugs over the Internet on July 30, 1999.
The statement can be found at www.usdoj.gov/criminal/cybercrime/fong9907.htm.
Guidance on Implementing the Electronic Signatures in Global
And National Commerce Act (E−SIGN)
The Electronic Signatures in Global and National Commerce Act (E−SIGN) was enacted on June
30, 2000. E−SIGN applies broadly to Federal and state statutes and regulations governing private
sector (including business−to−business and business−to−consumer) activities. The Act generally
requires that agencies permit private parties to conduct business and retain records electronically,
using electronic signatures. Agencies may also establish appropriate performance standards for the
accuracy, integrity, and accessibility of electronic records. Agency activities and requirements that
do not relate to business, commercial, or consumer transactions are not within the scope of this
legislation; they are instead addressed by the Government Paperwork Elimination Act. ESIGN
begins to take effect on October 1 of this year, with later dates for recordkeeping and certain other
activities regulated by the Federal Government. The OMB has issued a guidance memorandum on
implementing this Act. Any questions related to specific legal issues regarding this guidance may be
referred to the Justice Department at ; specific questions about the legislative
history of E−SIGN may be referred to the Commerce Department at .
Part I: General Overview of the E−SIGN Act
Public Law No. 106−229 (As it Relates to Federal Agencies) On June 30, 2000, the President
signed into law the Electronic Signatures in Global and National Commerce Act ("E−SIGN"). This
version explains E−SIGN as it relates to federal agencies, to assist them in becoming familiar with
these new requirements.
A. Basic Areas Covered by E−SIGN
E−SIGN promotes the use of electronic contract formation, signatures, and record−keeping in
private commerce by establishing legal equivalence between:
• Contracts written on paper and contracts in electronic form;
• Pen−and−ink signatures and electronic signatures; and
• Other legally−required written documents (termed "records") and the same information in
electronic form.
198
E−SIGN applies broadly to commercial, consumer, and business transactions affecting interstate or
foreign commerce, and to transactions regulated by both Federal and state government. If there is
no writing required by another law, E−SIGN does not apply. In general, subject to the limits
discussed in B. below, E−SIGN applies to the following areas:
1. Regulation of Private Parties' Contract Formation — If all parties to a contract choose to use
electronic signatures and records, E−SIGN generally grants legal recognition to those
methods. E−SIGN provides that no contract, signature, or record shall be denied legal effect
solely because it is in electronic form. Nor may a contract relating to a transaction be denied
legal effect solely because an electronic signature or record was used in its formation
(Section 101(a)). Beginning October1, 2000, E−SIGN will supersede all statutes or agency
rules containing paper−based requirements that might otherwise deny effect to electronic
signatures and records in consumer, commercial or business transactions between two or
more private parties, providing that all the contracting parties agree to the use of electronic
methods. E−SIGN preserves agencies' existing authority, however, to set standards for the
integrity, accuracy, and accessibility of electronic records and the authentication of electronic
signatures. Such standards must be consistent with E−SIGN and substantially justified. They
must also satisfy other statutory criteria (as described in detail in Part III).
2. Legally Required Notices and Disclosures in Private Transactions — Many Federal, State,
and local laws or rules require that parties receive notices and disclosures in connection with
private transactions (for example real estate purchases and settlements). To the extent
these laws or rules require paper notices, E−SIGN largely supersedes them. Effective
October 1, 2000, the notices may be in electronic form, provided that all involved parties
agree. E−SIGN establishes special requirements for the use of electronic notices and
disclosures in consumer transactions. A consumer must specifically "opt−in" to receiving
electronic notification according to requirements spelled out in detail in the statute (Section
101(c)). Please note that E−SIGN does not give legal effect to the use of electronic notices
of home mortgage foreclosures, evictions, repossessions, termination of utility services,
cancellation of health or life insurance, and product recalls (Section 103(b)(2)). Also,
E−SIGN does not affect the proximity requirements of any other law with respect to any
warning, notice, disclosure, or other record required to be posted or displayed.
3. Record Retention Requirements — If a Federal law or regulation requires that a document
(or particular information) be retained by an individual or company, E−SIGN adds an
electronic option. Effective March 1 (if no new regulation is in process), or June 1, 2001 (if a
regulation is being revised), retention may be electronic so long as the electronic record
accurately reflects the information set forth in the record, and remains accessible in a form
that can be accurately reproduced for later reference (Section 101(d)). As noted below,
agencies also may promulgate performance standards to ensure the accuracy, integrity and
accessibility of electronic records (Section 104(b)(3)).
4. Filings — E−SIGN generally preserves an agency's existing authority to specify standards
and formats for records filed with the agency (Section 104(a)). Federal agencies have
separate obligations, however, under the Government Paperwork Elimination Act
("GPEA")(Title XVII of Pub. L. No. 105−277) to accept most electronic records submitted by
the public (See Section 104(c)(2)). [1] Under GPEA, agencies must generally provide for the
optional use and acceptance of electronic documents, signatures, and recordkeeping, when
practicable, by October 2003. GPEA seeks to increase the ability of citizens to interact with
the Federal government electronically.
5. Federal Agency Contracts — E−SIGN does not force contracting parties (whether the
government or the private sector) to use or accept electronic signatures and records. If
agencies and the parties with whom they contract choose to use electronic methods,
E−SIGN gives legal effect to those methods. Moreover, E−SIGN expressly permits agencies
to require the use of specific technologies (such as specific authentication methods) in
199
connection with Federal procurement contracts (Section 104(b)(4)). It is important to
distinguish these points from other, non−procurement electronic transactions provided for
under GPEA, where Federal agencies are compelled (when practicable) to accept electronic
forms with electronic signatures by October 2003.
B. Governmental Activities
Congress specifically rejected the inclusion of the term A "governmental transactions" in the
definition of transactions subject to E−SIGN, although that term did appear in earlier versions of the
bill. See Section 106(13) (defining covered transactions). E−SIGN does not prescribe requirements
pertaining to activities that are governmental (as opposed to business, consumer, or commercial) in
nature, including activities conducted by private parties principally for governmental purposes. One
example of an activity that is governmental is census reporting and related requirements. When
government agencies choose to engage in commercial transactions, E−SIGN does apply, permitting
(but not required) the use of electronic methods. See above ("Federal Agency Contracts").
Note that if a transaction is not within the scope of E−SIGN because it is governmental, rather than
commercial, consumer, or business in nature, agencies must still pursue options for electronic
collection, maintenance, and disclosure of information, as well as electronic signatures, under
GPEA. The latter statute generally requires agencies to recognize the validity of electronic
submissions in their programs by October 2003 (when practicable), in accordance with guidance
issued by the Office of Management and Budget.
C. Preservation of Agency Authority
If an agency is responsible for issuing rules under a statute (pursuant to rulemaking authority
granted by that statute or some other statute), E−SIGN preserves that agency's authority to issue a
rule, order or other guidance of general applicability interpreting the impact of E−SIGN on that
statute (Section 104(b)). These rules must be:
• Consistent with Section 101 of E−SIGN and not add to its requirements;
• Supported by a substantial justification;
• Substantially equivalent to similar requirements imposed with respect to non−electronic
contracts, notices, and retained records;
• Reasonable in the costs they impose; and
• Technology neutral (Section 104(b)(2)).
To the extent authorized by statute, an agency may:
• Issue rules requiring the use of an authentication technology providing a particular level of
security (but generally not the use of one specific technology, unless certain requirements
are met) for contract formation or for signing of notices or disclosures;
• Issue interpretive rules or other guidance regarding the application of the consumer consent
provisions to the particular notices or disclosures within the agency's jurisdiction;
• Issue interpretive rules or other guidance regarding the agency's record retention rules,
including the specification of performance standards required to assure accuracy, record
integrity, and accessibility of the records that are required to be retained (Section 104(b)(3)).
An agency may not require the use of a specific technology unless necessary to meet an important
government objective (for example, ensuring that personal information is kept private). It also may
not require that a record be retained in paper form unless it is essential to attaining a compelling
governmental interest relating to law enforcement or national security.
200
Part II: Suggested Steps for the Implementation of E−SIGN
Beginning on October 1, 2000, E−SIGN will supersede many provisions in Federal and State
statutes and agency regulations requiring the use of paper records and ink signatures in
commercial, consumer, and business transactions.
The statutes and regulations affected by E−SIGN include those that impose requirements for
contract formation, record retention, and notices and disclosures by private parties (that relate to
business, consumer, or commercial, rather than governmental, activities). E−SIGN also provides
special rules and effective dates for government and government−guaranteed loans.
Agencies should immediately begin to identify which of their regulations or other requirements may
be subject to E−SIGN. They should decide whether they need to revise any of their regulations or
requirements in light of the legal status accorded to electronic records and signatures under
E−SIGN. They should work with their customers and regulated communities in this process to help
ensure that they understand the scope of E−SIGN. They should issue a general notice or group of
notices for comment as to what guidance or regulations should be amended.
We recommend that agencies follow these steps:
1. Identify Affected Agency Regulations, Policies, and Procedures. E−SIGN could potentially
affect any statute or agency regulation, policy, or procedure that requires private parties to
conduct transactions using paper records and ink signatures. As a first step, you should
review your statutes, regulations, policies, and procedures to determine whether they come
within the scope of E−SIGN. You should specifically examine those relating to transactions
between private parties (for example, contract formation, notices, disclosures), record
retention, filings, government guaranteed loans and mortgage insurance, as well as those
governing situations in which the government is a market participant. Part III of this
Guidance contains a detailed discussion of the scope of E−SIGN and how it may apply to
these specific areas.
2. Determine Whether it is Necessary to Issue Guidance or Regulations Concerning the Use of
Electronic Records or Signatures in Particular Transactions. Consistent with the intent of
E−SIGN, you generally should not restrict whether and how private parties use electronic
records and signatures in their dealings. You may need to provide guidance or standards for
the use of electronic records or signatures in some contexts in order to implement statutory
requirements that you administer. Part III discusses the types of situations in which there
may be substantial justification for you to issue guidance or set standards on the use of
electronic records and signatures.
3. Determine the Extent to Which You Have Authority to Issue Guidance or Regulations
Concerning the Use of Electronic Records or Signatures in Particular Transactions. E−SIGN
generally allows you to interpret how its requirements apply to your statutes and regulations.
You have varying levels of discretion to issue guidance or regulations for different types of
transactions. You have more discretion to establish standards in connection with record
retention requirements than in connection with the formation of contracts between private
parties. Part III discusses the scope of discretion with respect to the use of electronic
records and signatures in various types of transactions affected by E−SIGN.
4. Adopt Guidance or Regulations for the Use of Electronic Records and Signatures, Where
Necessary. If you determine that it is necessary to issue new or amended regulations,
policies, or procedures to establish standards for electronic records or signatures, you
should ensure that you do so in compliance with the requirements of E−SIGN as well as
other applicable laws, such as GPEA. If your regulation contains information collections
under the Paperwork Reduction Act ("PRA"), and thus is subject to GPEA, you should
201
address options for automating these collections as part of your planning for GPEA
implementation.[2]
You should initiate any needed changes to your regulations that affect contract formation, notices,
or disclosures between private parties involving business, consumer, or commercial transactions —
or draft new regulations if necessary — by October 1, 2000, the general effective date for E−SIGN,
or as soon as possible thereafter. In light of the close proximity of E−SIGN's effective date, you may
wish to consider whether interim final or direct final regulations are appropriate. You should not wait
to complete your GPEA plans that are due October 31, 2000 to pursue such regulatory actions.
A. Special Rules for Specific Types of Regulations
1. Record Retention Requirements — Once E−SIGN becomes effective, private parties may
keep electronic records instead of paper records of covered transactions provided the
electronic records meet certain accuracy and accessibility requirements in the E−SIGN
statute. Agencies should review their record retention regulations to determine whether
changes are needed for mission performance or for future audit or law enforcement
purposes. An agency may need to update requirements for paper records or adopt
performance standards for accuracy, integrity, and accessibility of electronic records in order
to maintain the effectiveness of record retention requirements. Part III discusses an agency's
authority to issue performance standards for the use of electronic records.
Record retention requirements imposed by Federal laws and by State laws administered by
a State agency will be subject to E−SIGN beginning on March 1, 2001. (Record retention
requirements imposed by State laws that are not administered by a State agency are subject
to E−SIGN beginning October 1, 2000.) If on March 1, 2001, an agency has announced,
proposed or initiated (but not completed) a rulemaking to prescribe performance standards
for electronic records used to meet a record retention requirement, the effective date of
E−SIGN as to that requirement will be June 1, 2001. Accordingly, agencies should
commence any rulemaking as soon as possible but no later than March 1, 2001, in order to
complete the rulemaking by June 1, 2001. Agencies may wish to combine proposed
changes relating to record retention in a single proposed rule for administrative ease.
The PRA covers many regulatory record retention requirements for business, consumer, or
commercial transactions. When these regulations are information collections under the PRA,
and thus subject to GPEA (see discussion under Step Four above), agencies should
address options for automating these collections as part of their GPEA planning. Given the
considerably earlier effective dates for E−SIGN than for GPEA, changes in record retention
regulations should be given high priority in the GPEA plans that are due by October 31,
2000.
2. Filing Requirements — Under E−SIGN, agencies generally can specify standards and
formats for records. They must adapt standards for the filing of electronic filings for most of
their processes, consistent with the standards and timetables in GPEA. Agencies should
review their regulations that relate to filings to determine whether changes are needed. They
should decide any on such changes by October 31, 2000, the deadline for GPEA plans.
Agencies should refer to OMB Memorandum M−00−10, "Implementation of the GPEA," for
general guidance in this area, and to OMB's procedural guidance on developing GPEA
plans, issued July 25, 2000, for specific instructions.
3. Federal Loan Guarantees and Mortgage Insurance — Agencies should also examine their
regulations governing transactions related to federal loan guarantees, mortgage insurance,
and commitments for these obligations. Some agency regulations set rules for
communication between lenders (for example, financial institutions) and borrowers (for
example, homeowners or students) in such transactions. Due to the importance of
202
preserving loan documentation, an agency should carefully examine the extent to which it
needs to specify standards for the accuracy, integrity, and accessibility of electronic loan
documentation methods.
E−SIGN applies to transactions involving mortgage insurance, loan guarantees, loan
guarantee commitments, and other programs listed in the Federal Credit Supplement,
Budget of the United States (FY 2001). E−SIGN applies to such transactions and to any loan
or mortgage which is made, insured, or guaranteed by the United States under this
supplement on or after June 30, 2001 (one year after E−SIGN became law). If agency
regulations related to these loan transactions contain information collections under the PRA,
they are subject to GPEA, and agencies should address options for automating these
collections as part of their GPEA planning.
Part III: A Description of E−SIGN's Requirements
The following discussion seeks to explain E−SIGN's specific requirements. Agencies may also
benefit from the discussion of E−SIGN's legislative history in Exhibit 1. [3]
Exhibit 1: Legislative History of E−SIGN
At the time E−SIGN was passed, a number of Senators and Representatives made floor statements
about E−SIGN, Especially comprehensive statements were delivered by Senators Hollings, Wyden,
and Sarbanes, who made a joint statement, and by Congressman Dingell, who made two
statements. The joint Senate statement and the first statement of Congressman Dingell were very
similar. 146 Cong. Rec. S5229 (June 16, 2000); 146 Cong. Rec. H4357 (June 14, 2000); 146 Cong.
Rec. E1071 (June 21, 2000). Senator Abraham and Congressman Bliley also made extensive
statements, which were likewise similar to one another. 146 Cong. Rec. S5283 (June 16, 2000);
146 Cong. Rec. H4352 (June 14, 2000). In signing E−SIGN, the President stated that he did so
with the understanding, reflected in the Congressional Record statements of
Senators Hollings, Wyden, and Sarbanes, and Congressman Dingell, that this Act
gives State and Federal governments the authority they need to establish record
retention requirements, prescribe standards and formats for filings, and issue other
regulations and orders to implement the legislation necessary to prevent waste,
investigate and enforce the law, operate programs effectively, and protect consumers
and the public interest. As they explained, this legislation principally addresses
commercial and consumer activities, not governmental activities that have already
been addressed by the Government Paperwork Elimination Act. To the extent that
these two laws overlap, I instruct Federal agencies to construe them in a manner
consistent with protecting the public interest and effectively carrying out agency
missions.
The floor statements of the legislation's sponsors contain a number of statements that may be
helpful to agencies seeking to construe E−SIGN. Of particular help may be the statements
specifically cited by the President in his signing statement. These statements include, for example,
Congressman Dingell's statement about the scope of E−SIGN:
[t]he Conferees specifically rejected including 'Governmental' transactions. Members
should understand that this bill will not in any way affect most Governmental
transactions, such as law enforcement actions, court actions, issuance of
Government grants, applications for or disbursement of Government benefits, or
other activities that the Government conducts that private actors would not conduct.
203
Even though some aspects of such Governmental transactions (for example, the
Government's issuance of a check reflecting a Government benefit) are commercial
in nature, they are not covered by this bill because they are part of a uniquely
governmental operation. Likewise, activities conducted by private parties principally
for governmental purposes are not covered by this bill. Thus, for example, the act of
collecting signatures to place a nomination on a ballot would not be covered, even
though it might have some nexus with commerce (such as the signature collectors'
contract of employment).
A. Regulating Transactions Between Private Parties (Contract Formation, Notices, and Disclosures)
1. When Does E−Sign Apply?
a. Contract formation. Regulations that directly regulate the form or content of legal
agreements in commercial, consumer or business transactions between private
parties are generally within the scope of E−SIGN. They must allow the parties to use
electronic contracts.
Illustration Person A is selling substance S to person B in a commercial
1:
transaction. Agency ABC currently requires that all private contracts for
the sale of substance S be recorded on blue paper. E−SIGN applies to
this requirement, so assuming A and B agree to use an electronic
record to evidence their contract, they do not need to use paper of any
type.
Illustration Person A is selling substance S to person B in a commercial
2:
transaction. Agency ABC has adopted a regulation requiring that all
electronic contracts for the sale of substance S be electronically signed
with a particular signature method. E−SIGN applies, and the regulation
must meet the standards set forth in Section 104 governing the use of
agency interpretive authority (see Section III(A)(3) below).
b. Notice and disclosure requirements. E−SIGN generally applies to all requirements
that private parties undertake such activities as signing documents or exchanging
disclosures during the course of commercial, consumer or business transactions.
Illustration Person A is selling substance S to person B in a commercial
1:
transaction. Agency ABC requires that when substance S is sold, a
separate disclosure form must be provided. E−SIGN applies to the
disclosure form, so (assuming the parties agree) the disclosure may be
in electronic form.
There may be narrow circumstances in which requirements imposed on
private−party transactions are not within the scope of E−SIGN, for
example, where they do not "relate to" the transaction. We expect such
[a]
situations to arise infrequently. In addition, private−party transactions
that are principally undertaken for a governmental purpose do not fall
under the scope of E−SIGN.
[a]
There are also certain categories of requirements that are not subject to E−SIGN
at all. See, for example, Section 101 (f) (referring to public notices).
c. Additional requirements for consumer transactions. Section 101(c) requires that
for transactions that involve a consumer, [4] electronic records may be substituted for
paper versions only if the consumer affirmatively consents to receive the documents
204
in electronic form and several other requirements are met. These include, among
other things, that the consumer receive a clear and conspicuous statement of: (1) the
consumer's right to receive paper records; (2) the consequences of later withdrawing
consent to receive electronic records; and (3) the hardware and software
requirements for access to and retention of electronic records. This provision is
especially significant, since many laws require that individuals receive information in
paper form in connection with private transactions, including extensions of credit by
financial institutions and the sale of real estate.
The consumer must provide the affirmative consent electronically in a manner that
reasonably demonstrates that the consumer is able to access the electronic records
that are the subject of the consent. Section 101(c) seeks to ensure that existing
consumer protections based on paper disclosures to consumers are not undermined
by the use of electronic disclosures in cases where consumers do not have the
capability to receive such disclosures or may not be fully aware of the consequences
of agreeing to receive such disclosures electronically.
Agencies should review the extensive consumer disclosure provisions contained in
Section 101(c) of E−SIGN, which are not reviewed in full here.
2. Should Agencies Issue Guidance or Regulations on How Parties May Contract or
Provide Notices Electronically?
When agencies assess their regulations affecting private−party transactions, they should
first consider two things:
♦ what the regulated persons might do on their own (that is, forms they might choose
to use in their transactions), and
♦ whether there are any substantial policy reasons to issue guidance or regulations
with respect to the parties' choice of method
a. What would regulated parties do in the absence of rule revision?
In general, starting on October 1, 2000, those who formerly had to use
paper−and−ink contracts, notices, and disclosures need no longer do so. At least in
the short run, however, most contracting parties will continue to use paper B perhaps
out of habit, or due to unfamiliarity with new methods, or for other purposes. Other
parties will begin immediately to use electronic formats for their contracts. Agencies
should ensure that they are aware of what approach regulated parties are taking to
electronic transactions.
Illustration Person A is contracting with person B to sell product M in a commercial
1:
transaction. Agency ABC requires that contracts for the sale of product
M be in writing. (They need not, however, be filed or retained.) Agency
ABC elects not to issue a new regulation in response to E−SIGN.
Starting on October 1, 2000, A and B may use any electronic form they
agree on for their contracts. E−SIGN ensures that Agency ABC's
regulation will not deny the contracts legal effect solely because they
are in electronic form.
b. Is there a substantial policy reason to issue guidance or regulations concerning the
parties' choice of contracting or disclosure method? As a rule, parties should be left
to choose the electronic contracting method they will use. There may be some
circumstances, however, in which substantial policy reasons require that agencies
issue guidance or regulations concerning this issue. For example, the agency may
205
want to ensure that consumers or businesses have accessible copies of electronic
contracts or disclosures relating to certain types of transactions. An agency may wish
to solicit comments from regulated entities, consumers, and the public at large as to
whether issuance of guidance or regulations is appropriate to address substantial
policy concerns. These comments could help the agency identify issues that should
be addressed in any guidance or regulation.
Illustration 1:
Product M is often counterfeited. Agency ABC has issued a
regulation requiring that all contracts for the sale of Product M be
in writing and contain certain terms, for the protection of
consumers who later discover that they have purchased a
counterfeit product. Agency ABC is concerned that, if product M
is sold electronically in a way that leaves many consumers with
poor records of the transaction, those who buy counterfeits may
be unable to obtain relief. Agency ABC may conclude that it is
appropriate to issue regulations interpreting the provisions of
E−SIGN to address this risk.
3. What is an Agency's Interpretive Authority?
If E−SIGN applies (section (1) above) and it is necessary to interpret E−SIGN (section (2)
above), agencies should consider issuing rules or guidance to do so, as discussed in part
I.C., above. Section 104(b)(1) of E−SIGN provides that only agencies with statutory authority
to issue rules may do so. Agencies with authority to issue guidance and orders as well as
rules may elect to issue guidance or orders. An agency's rules should interpret one of the
provisions in Section 101. A regulation or guidance could specify standards for signatures or
records used in meeting a particular statutory requirement. Agencies whose regulations
implement consumer disclosure requirements may consider the need to interpret various
terms used in Section 101(c) as they apply to the disclosure requirements the agency
administers. For example, an agency may consider the need to interpret the "clear and
conspicuous" requirement (Section 101(c)(1)(B)) or how a consumer "reasonably
demonstrates" the ability to access electronic records (Section 101(c)(1)(C)(2)).
Of course, agencies need not promulgate rules unless there are substantial reasons for
doing so. When agencies choose to do so, E−SIGN contains a number of specific
restrictions on agency rulemaking authority. While E−SIGN may help grant legal recognition
to electronic signatures and records, agencies still have the authority to impose some rules
to ensure the reliability, availability and integrity of contracts and records or when necessary
for other agency purposes.
a. Rules must be consistent with and not add to Section 101. (Section
104(b)(2)(A), (B)). These provisions require that regulations, orders, or guidance be
"consistent with" Section 101 and "not add to" the requirements of that Section.
Agency interpretations of these provisions are subject to the usual test for judicial
review of an agency's interpretation of a statute that it is charged with administering.
The agency may not deviate from the clear language of a statute but may construe a
statute where Congress' intent is not clear. [5]
b. Rules must be substantially justified. (Section 104(b)(2)(C)(i)). This provision
requires that the agency find that there is a "substantial justification" for the
regulation, order, or guidance. Agencies should not promulgate regulations unless
substantial policy reasons justify that they do so. If such policy reasons exist,
regulation may be appropriate. [6]
206
c. Rules must be substantially equivalent to those for paper records. (Section
104(b)(2)(C)(ii)(I)). This provision requires that "the methods selected to carry out"
the agency's purpose must be "substantially equivalent to the requirements imposed
on records that are not electronic records." In some circumstances, it may be
appropriate to assess "substantial equivalence" by considering general features of a
process (such as security, proof of identity, and the like), since electronic and paper
systems often operate by means that are not directly analogous. Systems may be
substantially equivalent at this higher level of generality even though their details are
quite dissimilar.
d. Rules may not impose unreasonable costs. (Section 104(b)(2)(C) (ii)(II)). This
provision requires that "the methods selected to carry out" the agency's purpose
must "not impose unreasonable costs on the acceptance and use of electronic
records." One factor in the reasonableness determination may be a comparison of
the cost and benefits of the proposed regulation. This comparison will presumably
resemble other analysis of regulatory costs and benefits.
e. Rules must be technology−neutral. (Section 104(b)(2)(C)(iii)). This provision
requires that "the methods selected to carry out" the agency's purpose must not
"require, or accord greater legal status or effect to, the implementation or application
of a specific technology or technical specification for performing the functions of
creating, storing, generating, receiving, communicating, or authenticating electronic
records or electronic signatures." Although this provision bars agencies from
prescribing specific technologies, it does not bar an agency from adopting a
performance standard for a particular technology. Such standards could address
such issues as security, record integrity, record or identity authentication, or
interoperability of systems. In some instances, agencies may be able to require the
use of a specific technology or technical specification. See Section 104(b)(3)(A),
discussed in Section III(B)(3), below.
f. Rules may not require the use of paper. (Section 104(c)(1)). This provision states
that agencies may not use their interpretive authority to "impose or reimpose any
requirement that a record be in a tangible printed or paper form." But see the
exception in Section 104(b)(3)(B), discussed in Section III(B)(3), below.
B. Record Retention Requirements
E−SIGN does not define "record retention" requirements. In its usual sense, however, the term
refers to requirements that a private party retain certain records so they will be available for audit or
law enforcement purposes.
Section 101 of E−SIGN contains specific provisions permitting the use of electronic records to
comply with record retention requirements if the record "accurately reflects the information set forth
in the contract or record," (Section 101(d)(1)(A)), and "remains accessible to all persons who are
entitled to access by statute, regulation, or rule of law, for the period required by such statute,
regulation, or rule of law, in a form that is capable of being accurately reproduced for later
reference, whether by transmission, printing, or otherwise," (Section 101(d)(1)(B)).
1. When Does E−SIGN Apply?
Record retention requirements for records generated in a commercial, consumer, or
business transaction are subject to E−SIGN.
Illustration 1:
Person A is selling substance S to person B in a commercial
transaction. Agency ABC requires that, when substance S is sold, a
207
copy of the contract of sale be retained for future audit or law
enforcement purposes. E−SIGN applies to this requirement, so the
contract may be retained in electronic form.
Records generated solely to comply with regulations (see illustration 2), rather than records
generated as part of a preexisting commercial transaction, are generally not subject to
E−SIGN. Record retention requirements of the former type are subject to GPEA, however,
and should be reviewed and addressed under the processes set forth in that Act.
Illustration Agency ABC requires that certain categories of businesses periodically
2:
commission audits of their consumption of substance S. The audits are
self−contained documents, created to government specifications, and do not
contain records of the underlying transactions. Agency ABC requires that the
businesses retain a copy of the audit, but does not require that the audits be
reported. E−SIGN does not apply. The requirement is not "related to" a
commercial transaction. The contract between the audited and auditing entity is
a commercial transaction, but one that occurs only to comply with this
governmental requirement.
2. Should the Agency Allow the Parties to Choose any Method for Retaining Records
Electronically?
As with regulation of private−party transactions, agencies should consider two things
regarding their record retention requirements. First, they should consider what the regulated
persons might do on their own (that is, what forms might they choose for retention absent
regulation). Second, agencies should consider whether there are any substantial policy
reasons to regulate the parties' choice of method.
a. What would regulated parties do in the absence of a rule revision?
In general, starting on March 1, 2001, regulated parties need no longer retain records
in paper form (so long as they keep them in an acceptable electronic form). Many
parties may continue to keep their records on paper, others may prefer that
electronic forms of record retention. This is especially true for transactions that were
originally undertaken in electronic, rather than written form.
Illustration Agency ABC regulates the sale of a commodity that raises significant
1:
regulatory concerns. Agency ABC requires suppliers of the commodity
to keep written records of all sales, so that, if necessary, it can track and
trace major purchasers and uses of the commodity. Starting on March
1, 2001, Corporation C and others begin to sell the commodity over the
Internet. C's computers keep an electronic copy of certain key
information on each purchase. Now that this information is stored
electronically, C and other distributors who use similar systems no
longer keep paper records of the transactions. Agency ABC should
review its record keeping regulations to insure that they are consistent
with the practices permitted by E−SIGN.
b. Is there a substantial policy reason to issue guidance or regulations with respect to
the parties' choice of record retention methods? Parties should be left to select an
electronic storage form of their own choosing where appropriate. There may be some
circumstances, however, in which substantial policy reasons require that agencies
regulate the parties' choice. For example, the agency may want to ensure that the
record has not been tampered with, that it is safe from inadvertent loss or
destruction, that the agency can read and access it, or that it contains all the
208
necessary information. We believe that many agencies will wish to issue guidance or
regulations addressing these issues.
Illustration The information about the regulated commodity transactions stored on
1:
C's system is kept in a database that is updated every minute. Any of
C's employees have access to the database and can change any of the
data in it. Agency ABC may wish to update its regulations to require that
the commodity sale records be maintained in a secure format if C's
current database management substantially impedes audits or
enforcement.
Illustration Agency ABC is also concerned about its ability to identify purchasers of
2:
the commodity through the sales records. Agency ABC has concluded
that regulated entities do not always preserve this information
adequately in their electronic systems. The agency may also wish to
issue an updated regulation requiring that records be maintained in a
format that accurately and reliably reflects the identity of the purchaser.
Illustration In some cases, Agency ABC has a need to refer to the commodity sales
3:
records for several years after a sale occurs. Realizing that computer
systems and database software used in the industry change frequently
as technology advances, Agency ABC may want to issue an updated
regulation requiring that records be maintained over time in a format
that is reasonably accessible to government investigators.
3. What is an Agency's Interpretive Authority?
If E−SIGN applies (Section 1 above) and it is necessary to interpret E−SIGN (Section 2
above), agencies may wish to issue rules or guidance to do so. E−SIGN provides, in Section
104(b)(1), that only agencies with preexisting statutory authority to issue rules may do so.
Agencies with authority to issue guidance and orders as well as rules may elect to issue
guidance or orders. These rules or guidance would interpret the provisions of Section
101(d). For example, agencies having the requisite rulemaking authority might interpret the
following aspects of Section 101(d)'s provisions with regard to their programs:
♦ What types of records will be deemed to "accurately reflect the information" (Section
101(d)(1)(A)) in a contract or record? Must the record be of a type that is read−only
or otherwise is non−alterable?
♦ What particular information "in the contract or record" (Section 101(d) (1)(A)) must be
reflected?
♦ What does it mean to "remain accessible" (Section 101(d)(1)(B))? Does that mean
that the hardware and software necessary to read the record must be kept available
too? If so, where must those materials be kept? To whom must they be available?
Who pays for that?
♦ Who are the persons "entitled to access" (Section 101(d)(1)(B))?
♦ What is the applicable period of time (Section 101(d)(1)(B)) for which the records
must be accessible?
♦ Regarding checks, what comprises the "information on the front and the back of the
check" (Section 101(d)(4))? Is this requirement satisfied by merely typing into a
database the handwritten name(s) that appears on the signature line and the
endorsement, or does it require scanning the signature and maintaining the image of
it in the database?
The general limitations on agency rulemaking authority discussed in part A.3. (See p. 12)
also apply here in the case of agency interpretations related to record retention
requirements. E−SIGN also contains specific provisions in Section 101 addressing record
209
retention, and provisions providing agencies with additional authority to regulate record
retention, including authority to adopt performance standards, and to require the use of
specific technologies or of paper in certain circumstances.
a. Requiring specific technologies. (Section 104(b)(3)(A)). As explained above,
E−SIGN generally permits agencies to adopt performance standards in regulations
interpreting Section 101. With respect to record retention requirements, E−SIGN
provides agencies with additional authority, stating that agencies may "specify
performance standards to assure accuracy, record integrity, and accessibility of
records that are required to be retained." Such standards would be interpretations of
the general provisions of Section 101(d).
E−SIGN permits agencies to adopt standards that are "specified in a manner that
imposes a requirement in violation of paragraph (2)(C)(iii)," — that is, that require the
use of a specific technology or technical specification — if the agency finds that the
requirement serves an important government objective and is substantially related to
the achievement of that objective.
Agencies may not "require use of a particular type of software or hardware in order to
comply with Section 101(d)." This provision is probably best read to mean that
agencies may not require use of the hardware or software of a specific manufacturer,
not that they may not set performance standards for hardware and software. The
statute permits agencies to require the use of a particular technology or technical
specification if the required findings are made.
Illustration Agency ABC wishes to ensure that records retained by private parties
1:
are kept in a format that cannot be tampered with and that it can easily
read with its equipment. The agency requires that records be retained
on a write−once, read−many device meeting an established industry
standard S. The only manufacturer that currently makes equipment
meeting that industry standard is Manufacturer M. The regulation is
permissible, assuming the other provisions of E−SIGN and any other
applicable laws are met.
Illustration The same situation as in Illustration 1, but Agency ABC specifically
2:
requires the use of equipment made by the Manufacturer M. The
regulation is not permissible.
b. Requiring use of paper. (Section 104(b)(3)(B)). This provision permits agencies to
require retention of a record in a tangible printed or paper form if there is a
"compelling governmental interest relating to law enforcement or national security for
imposing such requirement" and "imposing such requirement is essential to attaining
such interest."
C. Filing Requirements
E−SIGN preserves agencies' authority to specify standards and formats for records filed with the
agency (Section 104(a)). Therefore, as a rule, filing requirements will be governed by GPEA, not by
E−SIGN. GPEA generally provides for agencies to allow for the use and acceptance of electronic
signatures and records when practicable. GPEA sets timetables for this.
Agencies should review their regulations regarding filings to determine what changes, if any, are
needed in those regulations. Agencies should make any changes needed in this area by October
2003, the deadline under GPEA. To the extent that regulated filings are also information collections
210
under the PRA, agencies should address options for automating these transactions as part of their
GPEA planning.
D. Government Guaranteed Loans and Mortgage Insurance
These programs generally involve at least two contracts: A contract between the borrower and a
private lender, and a separate guarantee or insurance contract between the private lender and the
government. The government generally is not a party to the first contract (the loan or mortgage
transaction), but is a party to the second contract (the guarantee or insurance).
Although E−SIGN would not require the government to use or accept electronic signatures in its
guarantee or insurance contract (Section 101(b)(2)), the government may do so because of GPEA's
requirements. An agency can specify the format (for example, paper, with ink signatures, or a
particular technology or software) for records filed with that agency (Section 104(a)). An agency
could also require that crucial documents in the transaction (for example, copy of note and
mortgage) be filed with the agency or its contractor in whatever form the agency chooses.
Aside from the filing requirements discussed above, the agency might have less control over how
the loan or mortgage contract would be documented between the parties. To the extent that the
agency has rulemaking authority with regard to the transaction, however, it could interpret Section
101 accordingly. The agency also could interpret the record retention provisions of Section 101(d)
(subject to applicable restrictions in Section 104(b)). For example:
• The agency could interpret the terms (such as "accessibility") used in Section 101(d).
• Under Section 104(b)(3)(A) the agency could specify "performance standards to ensure
accuracy, record integrity, and accessibility of records."
• The agency could specify the specific technology that must be used to keep the records, if
the agency determines that such a requirement (i) serves an important governmental
objective, and (ii) is substantially related to the achievement of that objective.
Agencies need to act on loan provisions in time to meet the effective dates outlined in Part F below.
E. Government as Market Participant
1. When Does E−SIGN Apply?
Whether a particular action or interaction by a government agency is covered by Section
101(a) can be a complicated question. As explained in Part I, section B above, distinctively
governmental activities are not within the scope of E−SIGN. For example, particular activities
undertaken by an agency involving the government's obligations regarding Medicare are not
covered by Section 101(a), even though those activities may be analogous to activities
engaged in by a private party (e.g., provision of health insurance).
When the government engages in "business, consumer or commercial affairs," its actions
could be deemed "transactions" within the meaning of Section 101(a). In that event, the
question of whether Section 101(a) mandates the government's use or acceptance of
electronic signatures and records might depend on whether the transaction is a contract to
which the government is a party.
a. Contract to which agency is a party. Section 101(b)(2), in effect, states that Title I
of E−SIGN does not require agencies to "use or accept" electronic signatures or
records for contracts to which they are parties. [7]
211
An agency and a private party with whom it is contracting may choose by mutual
agreement whatever particular methodologies they wish to use. For example, they
could specify in the contract that certain notices or records must be on paper, with an
ink signature, or that the contract, notices or related records must be in a particular
electronic format or must use a particular type of software. Section 101 states
"[n]otwithstanding any statute, regulation, or other rule of law … ." Thus, the
operative portions of Section 101 trump statutes, regulations and rules of law, but
this should be read narrowly to leave open the option for parties to agree to
limitations on the use of electronic methods. The restrictions of Section 104 should
not apply to consensual agreements between the government and another party to a
government contract. The restrictions in Section 104 apply only to what the
government may require by regulations, not to what the government and those with
whom it contracts may agree upon.
Illustration An agency seeks to lease office equipment. E−SIGN would not require
1:
the agency to use or accept electronic signatures and records for the
lease itself, because the agency would be a party to the contract, but
the agency is likely to implement an electronic method under GPEA.
Illustration Assume the agency and the lessor enter into the lease (on paper, with
2:
ink signatures), and the lessor seeks to serve a notice (such as a notice
of a breach or foreclosure) electronically. The lease expressly states
that notices must be given in writing, signed with an ink signature. In
this case, the electronic notice was not sufficient. Even under E−SIGN,
parties to a contract (including the government, when it is a party) are
[a]
free to specify contract terms such as the form of notices.
[a]
Some might argue that, while Section 101(b)(2) states that the government will not
be forced to use or accept electronic records and signatures for contracts, that might
not apply to records other that the contract itself. They might assert that the
government must accept electronic notices under a contract. We would disagree
with that position. Section 101(b)(2) applies broadly to the entire transaction
involving a government contract, including all records relating to the contract. See id.
at H4357.
b. Agency is not a party to a contract. If an activity involves a "transaction"
(generally, the conduct of business, consumer or commercial affairs) that is not a
contract, or if it involves a contract to which the agency is not a party, Section 101(a)
might require recognition of electronic signatures and records (Section 101(b)(2)).
This could arise, for example, in the context of government loan guarantees and
mortgage insurance, to the extent that they are considered business, consumer or
commercial activities (See Section D).
To the extent the agency has rulemaking authority in connection with the transaction,
it may have the ability to interpret Section 101 in ways that will allow it some control
over the format of the transaction. It also might be able to require that records be
filed with the agency in specified formats.
2. Should an Agency Agree to Use Electronic Records and Signatures for Contracts to
Which It is a Party?
When the government is a party to a contract, it has the ability to determine, subject to
GPEA, whether to use and accept electronic methods, even if the other parties to the
contract wish to do so. Agencies should use their discretion, taking into account the
applicable requirements of GPEA as applied to the contract, and considering any policy
implications. Even when the government is not a party to a contract, in many instances it
212
may have a significant financial stake (such as the mortgage insurance and loan guarantee
contracts described above). It must assess whether it needs to take steps to ensure that it is
protected from financial loss that might occur if the private parties do not use means that will
allow the government to protect its rights in the transaction.
3. What is an Agency's Interpretive Authority?
To the extent that agencies determine that they need to have some control over, for
example, contracts between private parties that expose the government to liability or loss
(for example, government guaranteed loans by a private lender to a borrower), agencies
may use their rule−making authority, as discussed above. Further, to the extent that
agencies need to require that certain documents in the underlying transaction (for example,
the underlying loan contract) need to be submitted to the agency (directly or to a loan
servicer (a contractor) who maintains the records for the agency) Section 104(a) preserves
the agency's ability to require this.
4. How Does E−SIGN Apply to Transactions in which the Government is a Party?
Section 101(c) establishes a special rule for the use of electronic records in consumer
transactions (see Section A(1)(c) above). If a statute, regulation, or other rule of law requires
that information be provided to a consumer in writing, an electronic record of the information
may be used to fulfill this requirement only if the consumer affirmatively consents to the use
of the electronic record and several other requirements spelled out in Section 101(c) are
satisfied. Under the Act, a consumer is an individual who obtains products or services
primarily for personal, family, or household purposes (Section 106(1)).
The requirements of Section 101(c) likely will apply to a federal agency in very limited
circumstances. First, these requirements will apply only where the agency is engaging in a
transaction as a market participant (as opposed to strictly governmental transactions related
to taxation or public benefits administration) and the agency is providing products or services
directly to a consumer. Second, there must be a statute, regulation, or other law requiring
the consumer to receive certain information relating to the transaction in writing. Third, the
agency must seek to require the consumer to receive that information electronically. Fourth,
the information must not be part of a contract to which the agency is a party.
F. Effective Dates
See Exhibit 2 for effective dates of the provisions.
Exhibit 2: Effective Dates
Provision
Effective Date
October 1, 2000
• General effective date for the provisions of Title I (Electronic
Records and Signatures in Commerce) except for the
provisions discussed below.
Any record retention requirement imposed by:
March 1, 2001
i. a Federal statute, regulation, or other rule of law, or
ii. a State statute, regulation, or other rule of law administered
or promulgated by a State regulatory agency.
June 1, 2001
• If on March 1, 2001, a Federal regulatory agency or State
regulatory agency has announced, proposed, or initiated, but
213
not completed, a rulemaking proceeding to prescribe a
regulation under Section 104(b)(3), with respect to a record
retention requirement, Title I (Electronic Records and
Signatures in Commerce) shall be effective on June 1, 2001,
with respect to such requirement.
• With regard to any transaction involving a loan guarantee or
loan guarantee commitment (as those terms are defined in
Section 502 of the Federal Credit Reform Act of 1990), or
involving a program listed in the Federal Credit Supplement,
Budget of the United States, FY 2001, Title I (Electronic
Records and Signatures in Commerce) applies only to such
transactions entered into, and to any loan or mortgage made,
insured, or guaranteed by the United States Government
thereunder. Note that this includes most transactions
involving loan guarantees and mortgage insurance programs
of federal agencies.
• June 30, 2001 (On or
after one year after
the date of enactment
of the bill)
• Any records that are provided or made available to a
consumer pursuant to an application for a loan, or a loan
made, pursuant to title IV of the Higher Education Act of
1965
• Section 101(c) shall
not apply until the
earlier of C(a) such
time as the Secretary
of Education publishes
revised promissory
notes under Section
432(m) of the Higher
Education Act of 1965;
or (b) June 30, 2001.
• General effective date for the provisions of Title II
(transferable records)
• September 29, 2000
(90 days after date of
enactment of the bill).
[1]
Agencies should refer to OMB Memorandum M−00−10, Implementation of the GPEA, for general
guidance in this area, and to OMB's procedural guidance on developing GPEA plans, issued July
25, 2000, for specific instructions on actions to be taken.
[2]
The PRA defines an information collection as:
the obtaining, causing to be obtained, soliciting, or requiring the disclosure to an
agency, third parties or the public of information by or for an agency by means of
identical questions posed to, or identical reporting, record keeping or disclosure
requirements imposed on, ten or more person, whether such collection of information
is mandatory, voluntary, or required to obtain or retain a benefit.
— 5 C.F.R. 1320.3 (2000)
[3]
The examples and discussion that follow are intended as guidance and do not address every
possible situation. In some instances other circumstances may render a particular discussion or
illustration inapplicable.
[4]
Section 106(1) defines consumer as an individual who obtains, through a transaction, products or
services which are used primarily for personal, family, or household purposes, and also means the
legal representative of such individual.
214
[5]
Agencies should be aware of Congress's decision to reiterate this standard and be cautious in
exercising their interpretive authority. Congressman Dingell and Senators Hollings, Wyden and
Sarbanes explained in Senate and House floor statements that, because "each agency will be
proceeding under its preexisting rulemaking authority, … regulations or guidance interpreting
Section 101 will be entitled to the same deference that the agency's interpretations would usually
receive." 146 Cong. Rec. E1071 (June 21, 2000).
[6]
The Legislation's sponsors said in their floor statements that they intended that federal agencies
have authority to interpret E−SIGN in order to protect industry and consumers, address abusive
electronic practices, prevent waste, fraud and abuse, and enforce the law. 146 Cong. Rec. H4346,
H4358−59 (June 14, 2000); 146 Cong. Rec. E1071 (June 21, 2000).
[7]
Section 101(b)(2) states that Title I "does not…require any person to agree to use or accept
electronic records or electronic signatures, other that a governmental agency with respect to a
record other that a contract to which it is a party." Thus, Title I of E−SIGN does not require
governmental agencies to use or accept electronic records or signatures with regard to contracts to
which they are parties.
The Electronic Frontier: the Challenge of Unlawful Conduct
Involving the Use of the Internet
In August 1999, President Clinton established an interagency Working Group on Unlawful Conduct
on the Internet. Executive Order 13,133 directed the Working Group, under the leadership of the
Attorney General, to prepare a report with recommendations on:
• The extent to which existing federal laws provide a sufficient basis for effective investigation
and prosecution of unlawful conduct that involves the use of the Internet;
• The extent to which new technology tools, capabilities, or legal authorities may be required
for effective investigation and prosecution of unlawful conduct that involves the use of the
Internet; and
• The potential for new or existing tools and capabilities to educate and empower parents,
teachers, and others to prevent or to minimize the risks from unlawful conduct that involves
the use of the Internet.
Press Release
Attorney General Janet Reno today issued a report that presents an analysis of legal and policy
issues created by unlawful conduct on the Internet. The report, entitled The Electronic Frontier: The
Challenge of Unlawful Conduct Involving the Use of the Internet, is a product of the President's
Working Group on Unlawful Conduct on the Internet. The report finds that the Internet presents new
and significant investigatory challenges for law enforcement at all levels.
"The Internet has afforded our society unparalleled opportunities, many of which we are just
discovering, but it is also providing new opportunities for criminals to engage in crime," said Attorney
General Janet Reno. "Through the continued efforts of law enforcement and private industry we will
ensure that the Internet reaches its full potential for expanding communications, facilitating
commerce, and bringing countless other benefits to our society."
The report recommends a three−part approach to address unlawful conduct on the Internet and
concludes that:
• Regulation of unlawful conduct involving the use of the Internet should be analyzed through
a framework that ensures that online conduct is treated in a manner consistent with the way
offline conduct is treated, in a technology−neutral manner, and in a manner that recognizes
215
and protects privacy and civil liberties.
• Cybercrime presents unique and significant challenges to law enforcement which requires
resources for training, new investigative tools, legal authorities and capabilities.
• Continued support of private sector leadership is needed to promote and teach "cyberethics"
to empower Internet users to prevent and minimize the risks of unlawful activity.
The Working Group analyzed existing federal law for its applicability in cybercrime cases. It
determined that current law is appropriate in most cases of fraud, child pornography, sale of
prescription drugs and controlled substances, firearms, gambling, alcohol, securities fraud and
intellectual property over the Internet. It also indicated a need for modification of certain procedural
and evidentiary laws in order for law enforcement to confront the challenges created by the Internet.
According to the report, the challenge facing law enforcement is the difficulty in finding criminals in
the Internet's multi−jurisdictional, global environment. The inability to track down sophisticated
criminals who hide their identities online, the need for better coordination among law enforcement
agencies, and the need for trained and well−equipped personnel at all levels of law enforcement is
critical to fighting cybercrime.
The report also states that when addressing these challenges, the government should carefully
consider all societal interests. A balance must be struck when investigating and prosecuting
criminals which takes into account free speech, protecting children, reasonable expectations of
privacy, broad access to public information, and legitimate commerce.
The interagency Working Group was established in August 1999 by a Presidential Executive Order,
under the leadership of the Attorney General, to address the issue of unlawful conduct involving the
use of the Internet. The working group was directed to perform their evaluation within the context of
current Administration policy which included promoting self−regulation in the industry, supporting
technology−neutral laws and recognizing that the Internet is an important resource for commerce,
communication and education.
The Working Group benefitted from the views of a variety of sources. Those providing input
included various entities of the federal government, state and local groups, industry groups, and
non−profit advocacy and civil liberties groups.
Fact Sheet (August 6, 1999)
• The Vice President announced today a new effort by the Administration to address unlawful
conduct involving the use of the Internet. Specifically, the Executive Order will create a
Working Group, chaired by the Attorney General, that will address legal and policy issues
relating to unlawful conduct on the Internet.
• While the Internet provides dramatic and exciting benefits to enhance our lives, it also allows
those who want to violate or evade the law an opportunity to reach exponentially greater
numbers of people. The Working Group provides a mechanism to take a comprehensive
look at our policies and assess the scope and applicability of current law to unlawful activity
on the Internet, the extent to which new technological tools or resources can help in the fight
against crime, and the potential to use other means to lower the risks from unlawful acts on
the Internet.
• In the spirit of the Administration's Framework for Global Electronic Commerce, the Working
Group will undertake its review in the context of Administration policy that emphasizes
industry self−regulation where possible, technology−neutral laws and regulations, and an
appreciation of the Internet as an important medium both domestically and internationally for
commerce and free speech.
216
♦ The Attorney General will serve as Chair for the Working Group, which will include:
♦ The Director of the Office of Management and Budget,
♦ The Secretary of the Treasury,
♦ The Secretary of Commerce,
♦ The Secretary of Education,
♦ The Director of the Federal Bureau of Investigation,
♦ The Director of the Bureau of Alcohol, Tobacco, and Firearms,
♦ The Administrator of the Drug Enforcement Administration,
♦ The Chairman of the Federal Trade Commission
♦ The Administrator of the Food and Drug Administration, and
♦ Other federal officials deemed appropriate by the Chair of the Working Group.
The Chair and Vice Chair of the Vice President's Electronic Commerce Working Group will serve as
liaisons to the Group.
• As it carries out its mandate, the Working Group will seek input from industry, consumer,
and other private sector groups, along with state and local law enforcement officials.
• The Executive Order provides that the Working Group will provide a report and
recommendations to the President and Vice President within 120 days on:
♦ The applicability of existing federal laws to unlawful conduct involving the use of the
Internet (e.g., sale of guns, explosives, controlled substances, and prescription
drugs);
♦ The need for new technological and legal tools to investigate and prosecute such
conduct; and
♦ The potential for new or existing tools to educate and empower parents, teachers,
and others to pre vent or to minimize the risks from unlawful conduct on the Internet.
Questions and Answers (August 6, 1999)
Answers
On August 5, 1999, President Clinton issued Executive Order 13133, which established a Working
Group to analyze the existence of unlawful conduct on the Internet and to prepare and report
recommendations based on its findings within 120 days. The specific topics that the group will be
addressing include the extent to which existing Federal laws provide a sufficient basis for effective
investigation and prosecution of unlawful conduct that involves the Internet; the extent to which new
tools, capabilities, or authorities may be required for effective investigation and prosecution of
Internet crime; and the potential for educating and empowering parents, teachers and others to
prevent or minimize risks from such unlawful conduct.
Internet Health Care Fraud
One Privacy Officer at the U.S. Department of Justice gave remarks on the prosecution of health
care fraud and the protection of health care privacy on the Internet. His speech focused on the
Federal government's fraud, consumer protection, and privacy protection efforts as they relate to the
Internet healthcare industry.
Remarks of John T. Bentivoglio, Special Counsel for Health Care Fraud and Chief Privacy Officer,
U.S. Department of Justice, at the Symposium on Healthcare Internet and E−Commerce: Legal,
Regulatory and Ethical Issues. The statement can be found at
217
www.usdoj.gov/criminal/cybercrime/healthsp.htm.
Jurisdiction in Law Suits
On June 29, 2000 D. Jean Veta, Deputy Associate Attorney General, testified before the House
Subcommittee on the Courts and Intellectual Property, Committee on the Judiciary, about on how
the Internet is changing the way in which federal and state courts and regulatory agencies conceive
of their jurisdiction in civil lawsuits involving private litigants.
D. Jean Veta, Deputy Associate Attorney General, United States Department of Justice
Subcommittee on the Courts and Intellectual Property, Committee on the Judiciary, United States
House of Representatives
10:00 AM
JUNE 29, 2000
Good morning, Mr. Chairman and Members of the Subcommittee. On behalf of the Department of
Justice, I appreciate this opportunity to appear before this Subcommittee and to share with you our
thoughts on how the Internet is changing the way in which federal and state courts and regulatory
agencies conceive of their jurisdiction in civil lawsuits involving private litigants.
"Jurisdiction" is a broad concept and can be used to refer to four separate concepts. First and most
commonly, jurisdiction refers to whether a court has the power to adjudicate claims against a litigant
— in legal parlance, whether the court has "personal jurisdiction" over the litigant. Second,
jurisdiction may loosely refer to whether a court proceeding is being held in the proper location, or
venue. A court that possesses personal jurisdiction over a defendant, but which is not the proper
venue for the action, might be said not to have "jurisdiction" over the lawsuit. Third, jurisdiction has
sometimes been used to refer to the decision of a court to apply one state's law over another's,
when the law of two or more states are relevant to a dispute. This is often referred to as "choice of
law." Last, jurisdiction can refer to the statutory grant of authority a state or federal regulatory
agency possesses. For example, when a court holds that an agency does not have "jurisdiction" to
regulate a certain activity, it is expressing its view that the legislature did not invest that agency with
substantive authority over that activity. [8]
Although all four concepts are longstanding and well−developed, their application to the Internet
raises new and difficult questions. As a starting point in addressing these issues, we believe the
principle articulated in the Report of the President's Working Group on Unlawful Conduct on the
Internet, which was chaired by the Attorney General, applies with equal force in the civil context —
online conduct should be treated the same as offline conduct, to the extent feasible. Additionally, we
do not believe that it is necessary or appropriate to develop an entirely new body of federal statutory
law to address cyber−jurisdiction issues. Rather, and for the reasons explained more fully below, we
believe that the courts are adequately developing jurisdictional jurisprudence under applicable state
and federal law, and should continue to take the lead on these issues.
We have narrowed the focus of this testimony in two ways we believe that the Subcommittee will
find helpful. First, we will concentrate on how these jurisdictional issues affect litigation and
regulation in the civil context. Second, we will focus on how these issues play out within the
boundaries of the United States, leaving most of the international jurisdictional issues for the State
Department to discuss in its testimony. We will therefore give the most attention to how jurisdictional
218
issues among the states and within the United States are being addressed. Not surprisingly, most of
these issues involve application of state longarm statutes and other state laws, and are not
appropriate subjects of federal regulation. We nevertheless agree with the Subcommittee that these
issues warrant careful thought and discussion by policymakers and other interested parties.
On behalf of the Department, I commend this Subcommittee for its foresight in holding this hearing
to assess the current state of the law regarding jurisdiction and the Internet. We believe that we can
best contribute to this dialogue by identifying the issues we think will likely present the greatest
challenges in the coming years in this difficult area.
Background
As the Supreme Court noted in its first major decision to grapple with Internet issues, the Internet is
"an international network of interconnected computers." [9] Cyberspace renders geographical
boundaries between states and nations less meaningful. Information placed on the Internet is
instantly available to anyone else who accesses the data, no matter where they are on the globe.
Indeed, while current Internet architecture allows Web site operators to restrict access to their sites
through the use of passwords or credit card numbers, such screening mechanisms do not usually
operate to screen people based on where they live and can be subverted by persons "posing" as
someone else using their credit card or password.
As the Commerce Department has stated, the Internet is now a driving force in our economy,
generating more than $5.3 billion in retail sales in the first quarter of 2000 alone. [10] The federal
government and the states have largely opted not to regulate this fledgling new medium at this time,
and businesses and individuals have taken advantage of this faster, less−capital−intensive means
of transacting business. Other individuals have availed themselves of the Internet's ability to
"broadcast" around the world to sell their products or speak their minds.
Some of these activities, as one might expect, have resulted in lawsuits. Businesses have sued one
another for breach of contract, based on contracts entered into over the Internet or involving
Internet−based services. Other companies have sued for infringement of their trademarks or under
statutes prohibiting "cybersquatting" (the practice of reserving a "Web address," such as
http://www.mtv.com/, in order to force MTV to purchase that name for its own use) or "spamming"
(the practice of sending unsolicited commercial electronic mail, or e−mail). Individuals maligned in
Internet publications have sued for defamation.
Because jurisdiction historically has been tied to physical location — whereby the key to
jurisdictional questions was determining where, geographically, an activity took place — the advent
of cyberspace and the Internet has predictably required policymakers, litigants, and academics to
step back and re−evaluate how jurisdiction is to apply in this new medium. We will now address
these jurisdictional issues.
Personal Jurisdiction
One of the most vexing issues raised in litigation involving the Internet is this: When a person
engages in wrongful behavior in cyberspace, where can he or she be sued?
The answer to this question generally depends, first and foremost, on state law. State long−arm
statutes govern the reach of a state's courts. Most states, however, define their long−arm statutes to
reach as far as the federal Due Process Clause will constitutionally permit.
The definition of permissible personal jurisdiction under the Due Process Clause has changed over
219
time. Until the 1940s, a court's jurisdiction depended upon a defendant's physical presence (or the
presence of her property) within the geographical boundaries of a state. In other words, a person
residing in State B could only be sued in a court in State A if she were served with process while
traveling in State A or if she owned property in State A and the lawsuit dealt with the property. [11]
Since 1945, the Court has interpreted the Due Process Clause more flexibly. [12] Under current law,
a state may exercise jurisdiction over an out−of−state resident if the court finds that "there exist
minimum contacts between the defendant and the forum state" and the state's exercise of personal
jurisdiction over the defendant would not offend "traditional notions of fair play and substantial
justice." [13]
A person is said to have "minimum contacts" with a state if she purposefully directs her activities
toward that state. [14] The existence of minimum contacts confers "specific" personal jurisdiction
over her and empowers a state to hale her into that state's court with respect to a lawsuit "aris[ing]
out of or relat[ing] to those" contacts. [15] If she has "continuous and systematic" interaction with the
state, the state has "general" personal jurisdiction over her and may exert its jurisdiction over her
with respect to any valid cause of action. [16]
Whether the exertion of personal jurisdiction is reasonable — that is, whether it adheres to
"traditional notions of fair play and substantial justice" — depends upon five factors: (i) the burden of
the out−of−state lawsuit on the defendant; (ii) the forum state's interest in resolving the dispute; (iii)
the plaintiff's interest in receiving convenient and effective relief; (iv) the interstate judicial system's
interest in obtaining the most efficient resolution of controversies; and (v) the shared interest of the
several states in furthering fundamental substantive social policies. [17]
The Court adopted this more flexible standard in recognition of the "fundamental transformation of
… [the] national economy over the years" and "the increasing nationalization of commerce." [18]
Under these circumstances, requiring a company that conducted business in several states to be
sued in those states was not unreasonable; most companies able to engage in interstate activities
were financially well−off enough to be able to defend themselves in legal actions in those distant
jurisdictions. The Internet arguably works another "fundamental transformation of … [the] national
economy" if the financial indicators are to be given any weight. Moreover, this transformation may
affect one of the principle assumptions of the "minimum contacts" rule. The barriers to entering the
Internet market — and offering goods on an interstate and international basis — are low, which
arguably makes it less reasonable to expect Internet start−up companies to defend themselves in
lawsuits throughout the United States.
The federal and state courts grappling with how personal jurisdiction applies on the Internet have
not questioned the "minimum contacts" framework. [19] Instead, they have devoted time to
analogizing Internet phenomena (Web pages, e−mail, the use of Internet equipment, and interactive
online activity) to "real−world" phenomena (national print or broadcast advertisements,
telemarketing, and physical distribution of goods).
Surveying these opinions reveals four primary approaches to determining whether a state court may
exert personal jurisdiction over a person based on her Internet activities consistent with the
constraints of the Due Process Clause. First, and most easy to analogize to the "real" world, a court
may ask whether the defendant specifically availed herself of Internet machinery located in a
particular state. Just recently, for example, the 10th Circuit Court of Appeals held that Oklahoma
had personal jurisdiction over Bell Atlantic because Bell Atlantic knowingly used an Oklahoma
Internet service provider's server equipment located in Oklahoma. [20] This rationale may also apply
when a person enters into a contract to use such services or equipment in a known jurisdiction. [21]
220
Second, and most useful for persons who post Web pages, a court may look to the level of
interactivity between the person's Web site and the users he is reaching in a particular state. The
leading case on the "interactivity" standard is Zippo Manuf. Co. v. Zippo Dot Com, Inc. [22] There,
the District Court defined a three−point, "sliding−scale" spectrum of interactivity. At one end of the
spectrum is the defendant who "clearly does business over the Internet." [23] Over him, personal
jurisdiction is appropriately exercised. At the other end is the defendant who has "simply posted
information on an Internet Web site which is accessible to users in foreign jurisdictions." [24] This sort
of "passive" activity, under the Zippo test, is insufficient to warrant the exercise of personal
jurisdiction. [25] The "middle ground" of the spectrum — which, admittedly, accounts for most of the
spectrum — is left to "interactive Web sites where a user can exchange information with the host
computer" and where "the exercise of jurisdiction is determined by examining the level of
interactivity and commercial nature of the exchange of information that occurs on the Web site." [26]
In this last context, jurisdiction may hinge on whether the party simply exchanged information from
the Web site or entered into a full−fledged contract for goods or services on that site.
Third, a court may look to the volume of business that an Internet company conducts with the
residents of the forum state. [27] Under such a test, companies doing substantial business with
residents of a state would be subject to jurisdiction, while companies engaged in a few small
transactions could not be hauled into that state's court. This test may, to some extent, take into
account the relatively small size of many Internet start−up companies; on the other hand, such an
approach may also disadvantage consumers.
Fourth, a court may examine the "effects" that a particular person's behavior has in a specific state.
In a trademark case alleging that a party's use of "nissan.com" and "nissan.net" infringed on Nissan
Motor Company's trademark, the District Court held that the defendant's collection of advertising
revenue from a state where the effects of its deception were felt was sufficient to confer specific
jurisdiction. [28] Similarly, the New Jersey Supreme Court recently held that a person sued for
defamation could be sued in New Jersey because the effects in New Jersey of his use of an
electronic bulletin board physically located elsewhere was sufficient to confer jurisdiction over him in
the New Jersey courts. [29]
These approaches, while seemingly different, actually dovetail nicely and will often yield the same
outcome when applied to the same facts. If, for example, a Web site operator "targets" residents of
a certain state — or, more broadly, residents living in the United States — the courts of that state (or
the United States, in the latter example) will likely be able to assert personal jurisdiction over the site
operator under any of the tests: such an operator is likely to have used machinery or entered into
contracts in that state, is likely to have a highly interactive site designed to reach customers of the
targeted jurisdiction, is likely to generate a substantial volume of business, and is likely to have
some effect in the target jurisdiction. This is not surprising, as this sort of purposeful direction at a
jurisdiction is part of the very definition of what amounts to "minimum contacts" under the Court's
post−1940s due process jurisprudence. [30]
As this brief survey of leading cases indicates, the courts are busy grafting the uniqueness of the
Internet onto the already−existing framework set out by the Supreme Court's due process
jurisprudence. At this point in time, they seem to be handling the task well, which counsels strongly
in favoring of allowing this precedent to develop without legislative intervention.
We observe that persons transacting business on the Internet are not entirely powerless to
influence whether another state's courts will have personal jurisdiction over them. In many cases,
the parties enter into contracts. One of the terms the parties may negotiate is a "forum selection
clause" that dictates where jurisdiction is appropriate. Such clauses may present unique problems
where Internet transactions are concerned; nonetheless, in appropriate circumstances they may
221
encourage the parties to reach a "meeting of the minds" in advance and simply resolve disputes in
the agreed−upon forum.
Internet users may also be able to take some unilateral actions to indicate that they do not wish to
"purposefully direct" their business to a certain forum. For example, a company could place a
banner on its Web site that stated that it intended to do business solely with New York residents
(and back that up by listing a 1–800 number that only worked from within New York, or requiring
purchasers to enter New York mailing addresses). As the Internet architecture evolves, Web site
operators may also be able to "screen out" users who do not claim to be from only those states with
which they want to do business. While these actions are no guarantee against the exertion of
authority, they would be relevant to a court's inquiry into intent.
Venue
The next "jurisdictional" topic is venue — that is, assuming that the state or federal court has
personal and subject matter jurisdiction over the lawsuit, where should the suit be litigated?
Like personal jurisdiction, venue has traditionally been pegged to geographic location. The federal
venue rule for diversity cases, for example, provides that venue is proper in one of three possible
judicial districts: a judicial district where any defendant resides if they all reside in the same state;
one where a substantial part of the events or omissions giving rise to the claim occurred; or, if
venue is not otherwise available, in a judicial district where any of the defendants is subject to
personal jurisdiction at the time the action is commenced. [31]
Because Internet communications and the attendant online activities "occur" somewhere, but not
necessarily in an easily identified judicial district, courts must address how these rules are to be
applied when an Internet transaction is implicated in a lawsuit. Of course, the parties can designate
by agreement where the suit is to be litigated. If the parties have not provided for venue by
agreement, the three traditional venue possibilities prescribed by federal statute will still provide the
full range of appropriate venues in most cases. Courts sitting in districts in which either of the
parties reside or in which significant parts of the disputed transactions occurred each have a
sufficient connection to the lawsuit to hear and decide it. One can also imagine disputes in the
online world in which, for example, courts in the district where one of the party's Internet service
provider maintains its equipment (and possibly evidence relating to the suit) may be a proper site for
the lawsuit. These situations may occur so infrequently that no special rules are necessary, and
resolution of them can be left to the courts on a case−by−case basis as they arise.
Choice of Law
A third question that courts adjudicating Internet disputes involving residents from different state are
forced to address is this: Which state's substantive law applies?
When the parties have entered into a contract, the answer is usually straight−forward — look to the
contract to see whether the parties have agreed upon which state's law is to govern any
disagreements involving the contract. As a general rule, as long as the contractual provision is
reasonable, courts will honor it. [32] Thus, as with personal jurisdiction and venue, parties entering
into business transactions can avoid some of the uncertainty in the law by including such clauses in
their negotiated documents. [33]
When a person commits a tort or does not enter into a contract with an enforceable forum selection
clause, the "default" choice of law controls. It is important to keep in mind that the state court
deciding the choice of law issue applies its own state's "choice of law" rule to render its decision. [34]
222
The states are currently split in using one of three "choice of law" rules.
Some states apply the rule from Restatement (First) of Conflict of Laws, which hinges its selection
of law on the state where the right to be asserted vested. This often translates into a requirement
that a state court apply the law of the state where the "last act" necessary to complete the tort
occurred. [35] Other states follow the Restatement (Second), which looks to the law of the state with
the "most significant relationship" to the action, and lists several factors to be considered in making
this assessment. [36] A last group of states follows an "interest" test and will apply the substantive
law of the state having the greatest policy interest in its law to the case. [37]
Choice of law issues are largely subject to debate in the "real world," and the complications
attendant to the doctrine are multiplied when the doctrine is applied to cyberspace. If, for example, a
person posts defamatory language on a Web site, a court following the First Restatement choice of
law rule might apply the law of the states where the defamatory statements are read, if reading the
defamatory material is deemed to be the "last act" of the tort. There is no evidence, however, that
the choice of law principles currently applied by the courts are inadequate to apply to lawsuits
involving the Internet. Thus, although choice of law issues are often difficult — in both the physical
world and the cyberspace cases — we again believe that the state and federal courts are best
suited to addressing these issues at this time.
Substantive Authority to Regulate
Unlike personal jurisdiction, venue, and choice of law, which are defined largely by constitutional
constraints and decisional law, jurisdiction as it refers to the substantive authority of a state or
federal agency is largely a creature of legislative design.
The substantive authority of federal agencies to regulate companies and individuals domestically —
that is, within the boundaries of the United States — is plenary once the terms of the authorizing
statute are satisfied. Likewise, the authority of a federal court to review such action is typically set
forth by statute. For example, the Administrative Procedure Act generally provides for the court's
review of final agency action.
Federal authority to regulate extraterritorially is less certain. The Restatement (Third) of Foreign
Relations provides a set of default rules that tie authority to regulate to one of several sovereign
interests. More specifically, § 402 the Restatement provides that a nation has jurisdiction to
prescribe law with respect to: (i) conduct that takes place within its geographic borders; (ii) the
status of persons within its geographic borders; (iii) conduct outside its territory that has or is
intended to have a substantive effect within its geographic borders; (iv) the activities, interest,
status, or relations of its citizens regardless of where they are in the world; and (v) certain conduct
outside its territory by any other person that is directly against the security of the state or against a
limited class of other state interests. [38]
Nations are also in the process of further clarifying and developing this area of law through treaty
negotiation. For example, as the State Department discusses in its written testimony, a Hague
convention on Jurisdiction and the Recognition and Enforcement of Foreign Civil Judgments is
currently under negotiation.
States, within the United States, are currently grappling with similar issues — namely, when it is
permissible to regulate the activity of companies that do business with its residents over the
Internet, but are physically located outside its boundaries. The reach of permissible state regulation,
like the reach of nations, is constrained. In the case of individual states, the constraint is imposed by
the state's authorizing statutes and the prohibitions of the socalled "dormant Commerce Clause,"
223
which in essence prohibits a state from discriminating against outof−state businesses.
Conclusion
Through this brief overview of the four major "jurisdictional" issues involving the Internet today, we
hope we have aided this Subcommittee in its thinking about the challenges that lie ahead and which
are most appropriate for federal oversight and involvement.
Thank you for the opportunity to testify today. I will be pleased to respond to your questions.
[8]
Jurisdiction can also refer to subject matter jurisdiction, which is prescribed to the federal courts
by statute.
[9]
ACLU v. Reno, 521 U.S. 844, 849 (1997).
[10]
See http://www.census.gov/mrts/www/current.html (visited June 24, 2000). Business to business
commerce may be even greater than this. According to a summary prepared by The Industry
Standard, forecasts for 2003 of the dollar value of transactions between U.S. businesses that are
conducted electronically range from $634 billion to $2.8 trillion. See Stacy Lawrence, Behind the
Numbers: The Mystery of B2B Forecasts Revealed, The Industry Standard, Feb. 21, 2000,
http://www.thestandard.com/ (visited June 28, 2000).
[11]
See, e.g., Pennoyer v. Neff, 95 U.S. 714 (1877).
[12]
International Shoe Co. v . Washington, 326 U.S. 310 (1945).
[13]
See World Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 491 (1980) (quotations omitted);
Burger King Corp. v. Rudzewicz, 471 U.S. 462, 476 (1982).
[14]
Burger King, 471 U.S. at 472.
[15]
Id.
[16]
See Helicopteros Nacionales de Colombia v. Hall, 466 U.S. 408 (1984).
[17]
Burger King, 471 U.S. at 477.
[18]
McGee v. International Life Ins. Co., 355 U.S. 220, 222−23 (1957).
[19]
We recognize that the courts could not depart from the standard, which is binding Supreme Court
precedent. We simply mean to observe that the courts have also not questioned whether the
premises of this precedent apply equally in cyberspace.
[20]
Intercon, Inc. v. Bell Atlantic Internet Solutions, Inc., 205 F.3d 1244 (10th Cir. 2000). Although
this case was heard in federal court on diversity jurisdiction grounds, the District Court applied
Oklahoma's long−arm statute.
[21]
See CompuServe, Inc. v. Patterson, 89 F.3d 1257 (6th Cir. 1996) (finding personal jurisdiction
over an Ohio defendant where defendant entered into a contract to distribute software through
plaintiff's Ohio Internet server and defendant repeatedly sent his software files to the Ohio server via
e−mail).
[22]
952 F. Supp. 1119 (W.D. Pa. 1997).
[23]
Id. at 1124.
[24]
Id. at 1124.
[25]
In some respects, this is a rejection of the "stream of commerce" theory, which provides that a
defendant should be subject to personal jurisdiction in any state where his product, floating down
the "stream of commerce," might foreseeably end up. See Asahi Metal Indus. Co. v. Superior Court
of California, 480 U.S. 102 (1987).
[26]
Zippo, 952 F. Supp. At 1124.
[27]
See, e.g., Note, Richard A. Rochlin, "Cyberspace, International Shoe, and the Changing Context
for Personal Jurisdiction," 32 Conn. L. Rev. 653, 671−72 (2000).
[28]
See Nissan Motor Co., Ltd. v. Nissan Computer Corp., 89 F. Supp. 2d 1154 (C.D. Cal. 2000).
[29]
See Blakey v. Continental Airlines, Inc., 164 N.J. 38 (N.J. 2000).
[30]
See supra note 6 and accompanying text.
[31]
See 28 U.S.C. § 1391(a). A defendant also has the right to ask the court to move venue to a
224
different, appropriately authorized venue, "[f]or the convenience of parties and witnesses [and] in
the interest of justice." See 28 U.S.C. § 1404(a).
[32]
See Gary B. Born, International Civil Litigation in the United States Courts: Commentary and
Materials 655 (1996).
[33]
On the other hand, courts may question whether the parties have come to a meeting of the minds
with regard to choice of law when a consumer has simply clicked "I agree" to a Web site operator's
extensive boilerplate as a condition to proceeding further into the Web site.
[34]
See Restatement (Second) of Conflict of Laws § 6(1) ("A court, subject to constitutional
restrictions, will follow a statutory directive of its own state on choice of law.").
[35]
See Restatement (First) of Conflict of Laws § 377 (1934).
[36]
See Restatement (Second) of Conflict of Laws § 145 (1971). Factors to be considered in
assessing which jurisdiction has the "most significant relationship" include: (i) the place where the
injury occurred; (ii) the place where the conduct causing the injury occurred; (iii) the domicile,
residence, nationality, place of incorporation and place of business of the parties; and (iv) the place
where the relationship, if any, between the parties is centered. Id. at § 145(2).
[37]
See generally Kermit Roosevelt III, "The Myth of Choice of Law: Rethinking Conflicts," 97 Mich.
L. Rev. 2448, 2461−65 (1999).
[38]
See Restatement (Third) of Foreign Relations § 402 (1986).
Electronic Case Filing at the Federal Courts
On February 9, 2001, the Department of Justice submitted comments to the Administrative Office of
the U.S. Courts in response to the federal judiciary's request for comments regarding the privacy
and security implications of public access to electronic case files. The issue of privacy and public
access to electronic case files is very important to the Department of Justice.
Abel J. Mattos
Chief, Court Administration Policy Staff
Court Administration Building, Suite 4–560
Administrative Office of the United States Courts
One Columbus Circle, N.E.
Washington, D.C. 20544
Dear Mr. Mattos:
I am pleased to enclose the comments of the Department of Justice in response to the federal
judiciary's request for comments regarding the privacy and security implications of public access to
electronic case files. The issue of privacy and public access to electronic case files is very important
to the Department of Justice, as we know it is to the judiciary. We welcome the opportunity to
continue the productive dialogue regarding these issues on an ongoing basis.
I would like to take this opportunity again to thank the Judicial Conference for allowing the
Department an extension of time to produce these comments. As you know this has been, and
remains, a period of transition for the Department. However, these comments represent the joint
efforts of a working group of attorneys from a variety of components of the Department of Justice,
including the Executive Office for United States Attorneys, the United States Trustee Program, the
Office of Information and Privacy, the Fraud and Computer Crimes and Intellectual Property
Sections of the Criminal Division, the Commercial Litigation, Federal Programs, and Torts Branches
of the Civil Division, the Tax Division, the Federal Bureau of Investigation, the Environment and
Natural Resources Division, the Justice Management Division, and the Office of Policy
Development. With the appointment of the new Attorney General, the Department will be returning
to full force at the leadership levels. We look forward to providing further thoughts and input,
whether in the form of continued communication between our staffs or more formal testimony.
225
If you have any questions regarding this document, please do not hesitate to call Jonathan Meyer,
Deputy Assistant Attorney General in the Office of Policy Development (202−307−3024), or
Jeanette Plante, Special Assistant United States Attorney (202−616−6459). Thank you again for the
opportunity to comment.
Sincerely,
/S/
Kevin R. Jones
Deputy Assistant Attorney General
Notes
1. Agencies should refer to OMB Memorandum M−00−10, Implementation of the GPEA, for general
guidance in this area, and to OMB's procedural guidance on developing GPEA plans, issued July
25, 2000, for specific instructions on actions to be taken.
2. The PRA defines an information collection as:
the obtaining, causing to be obtained, soliciting, or requiring the disclosure to an
agency, third parties or the public of information by or for an agency by means of
identical questions posed to, or identical reporting, record keeping or disclosure
requirements imposed on, ten or more person, whether such collection of information
is mandatory, voluntary, or required to obtain or retain a benefit.
— 5 C.F.R. 1320.3 (2000)
3. The examples and discussion that follow are intended as guidance and do not address every
possible situation. In some instances other circumstances may render a particular discussion or
illustration inapplicable.
4. There are also certain categories of requirements that are not subject to E−SIGN at all. See, for
example, Section 101 (f) (referring to public notices).
5. Section 106(1) defines consumer as an individual who obtains, through a transaction, products or
services which are used primarily for personal, family, or household purposes, and also means the
legal representative of such individual.
6. Agencies should be aware of Congress's decision to reiterate this standard and be cautious in
exercising their interpretive authority. Congressman Dingell and Senators Hollings, Wyden and
Sarbanes explained in Senate and House floor statements that, because "each agency will be
proceeding under its preexisting rulemaking authority, … regulations or guidance interpreting
Section 101 will be entitled to the same deference that the agency's interpretations would usually
receive." 146 Cong. Rec. E1071 (June 21, 2000).
7. The Legislation's sponsors said in their floor statements that they intended that federal agencies
have authority to interpret E−SIGN in order to protect industry and consumers, address abusive
electronic practices, prevent waste, fraud and abuse, and enforce the law. 146 Cong. Rec. H4346,
H4358−59 (June 14, 2000); 146 Cong. Rec. E1071 (June 21, 2000).
8. Section 101(b)(2) states that Title I "does not…require any person to agree to use or accept
226
electronic records or electronic signatures, other that a governmental agency with respect to a
record other that a contract to which it is a party." Thus, Title I of E−SIGN does not require
governmental agencies to use or accept electronic records or signatures with regard to contracts to
which they are parties.
9. Some might argue that, while Section 101(b)(2) states that the government will not be forced to
use or accept electronic records and signatures for contracts, that might not apply to records other
that the contract itself. They might assert that the government must accept electronic notices under
a contract. We would disagree with that position. Section 101(b)(2) applies broadly to the entire
transaction involving a government contract, including all records relating to the contract. See id. at
H4357.
10. Jurisdiction can also refer to subject matter jurisdiction, which is prescribed to the federal courts
by statute.
11. ACLU v. Reno, 521 U.S. 844, 849 (1997).
12. See http://www.census.gov/mrts/www/current.html (visited June 24, 2000). Business to
business commerce may be even greater than this. According to a summary prepared by The
Industry Standard, forecasts for 2003 of the dollar value of transactions between U.S. businesses
that are conducted electronically range from $634 billion to $2.8 trillion. See Stacy Lawrence,
Behind the Numbers: The Mystery of B2B Forecasts Revealed, The Industry Standard, Feb. 21,
2000, http://www.thestandard.com/ (visited June 28, 2000).
13. See, e.g., Pennoyer v. Neff, 95 U.S. 714 (1877).
14. International Shoe Co. v . Washington, 326 U.S. 310 (1945).
15. See World Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 491 (1980) (quotations omitted);
Burger King Corp. v. Rudzewicz, 471 U.S. 462, 476 (1982).
16. Burger King, 471 U.S. at 472.
17. Id.
18. See Helicopteros Nacionales de Colombia v. Hall, 466 U.S. 408 (1984).
19. Burger King, 471 U.S. at 477.
20. McGee v. International Life Ins. Co., 355 U.S. 220, 222−23 (1957).
21. We recognize that the courts could not depart from the standard, which is binding Supreme
Court precedent. We simply mean to observe that the courts have also not questioned whether the
premises of this precedent apply equally in cyberspace.
22. Intercon, Inc. v. Bell Atlantic Internet Solutions, Inc., 205 F.3d 1244 (10th Cir. 2000). Although
this case was heard in federal court on diversity jurisdiction grounds, the District Court applied
Oklahoma's long−arm statute.
23. See CompuServe, Inc. v. Patterson, 89 F.3d 1257 (6th Cir. 1996) (finding personal jurisdiction
over an Ohio defendant where defendant entered into a contract to distribute software through
plaintiff's Ohio Internet server and defendant repeatedly sent his software files to the Ohio server via
227
e−mail).
24. 952 F. Supp. 1119 (W.D. Pa. 1997).
25. Id. at 1124.
26. Id. at 1124.
27. In some respects, this is a rejection of the "stream of commerce" theory, which provides that a
defendant should be subject to personal jurisdiction in any state where his product, floating down
the "stream of commerce," might foreseeably end up. See Asahi Metal Indus. Co. v. Superior Court
of California, 480 U.S. 102 (1987).
28. Zippo, 952 F. Supp. At 1124.
29. See, e.g., Note, Richard A. Rochlin, "Cyberspace, International Shoe, and the Changing Context
for Personal Jurisdiction," 32 Conn. L. Rev. 653, 671−72 (2000).
30. See Nissan Motor Co., Ltd. v. Nissan Computer Corp., 89 F. Supp. 2d 1154 (C.D. Cal. 2000).
31. See Blakey v. Continental Airlines, Inc., 164 N.J. 38 (N.J. 2000).
32. See supra note 6 and accompanying text.
33. See 28 U.S.C. § 1391(a). A defendant also has the right to ask the court to move venue to a
different, appropriately authorized venue, "[f]or the convenience of parties and witnesses [and] in
the interest of justice." See 28 U.S.C. § 1404(a).
34. See Gary B. Born, International Civil Litigation in the United States Courts: Commentary and
Materials 655 (1996).
35. On the other hand, courts may question whether the parties have come to a meeting of the
minds with regard to choice of law when a consumer has simply clicked "I agree" to a Web site
operator's extensive boilerplate as a condition to proceeding further into the Web site.
36. See Restatement (Second) of Conflict of Laws § 6(1) ("A court, subject to constitutional
restrictions, will follow a statutory directive of its own state on choice of law.").
37. See Restatement (First) of Conflict of Laws § 377 (1934).
38. See Restatement (Second) of Conflict of Laws § 145 (1971). Factors to be considered in
assessing which jurisdiction has the "most significant relationship" include: (i) the place where the
injury occurred; (ii) the place where the conduct causing the injury occurred; (iii) the domicile,
residence, nationality, place of incorporation and place of business of the parties; and (iv) the place
where the relationship, if any, between the parties is centered. Id. at § 145(2).
39. See generally Kermit Roosevelt III, "The Myth of Choice of Law: Rethinking Conflicts," 97 Mich.
L. Rev. 2448, 2461−65 (1999).
40. See Restatement (Third) of Foreign Relations § 402 (1986).
228
Chapter 14: Legal Considerations in Designing and
Implementing Electronic Processes: A Guide for
Federal Agencies
Executive Summary
Under the Government Paperwork Elimination Act (GPEA), Pub. L. No. 105−277, §§1701−1710
(1998) (codified as 44 U.S.C.A. § 3504 n. (West Supp. 1999)), Federal Executive agencies are
required, by October 21, 2003, to provide for (1) "the option of the electronic maintenance,
submission, or disclosure of information, when practicable, as a substitute for paper," and (2) "the
use and acceptance of electronic signatures, when practicable." The Office of Management and
Budget (OMB) has developed guidance to assist agencies in implementing GPEA's requirements.
"Procedures and Guidance; Implementation of the Government Paperwork Elimination Act," 65 FR
25508, May 2, 2000 ("OMB Guidance"). As part of the OMB Guidance, the Department of Justice is
charged with developing, in consultation with federal agencies and OMB, practical guidance on
legal considerations related to agency use of electronic filing and recordkeeping. The purpose of
this Guide is to identify legal issues that agencies are likely to face in converting to electronic
processes and to provide some suggestions on how to address them. Agencies should also
consider the significance of the "Electronic Records and Signatures in Global and National
Commerce Act" (E−SIGN) (Pub.L. 106−229, § 1, June 30, 2000, 114 Stat. 464, codified at 15
U.S.C. §§ 7001–7006), although a detailed discussion of that statute's impact on the federal
agencies is beyond the scope of this Guide.
The rise of electronic commerce offers agencies exciting opportunities to convert — or redesign —
paper−based processes to electronic ones. While some agencies have experience using electronic
processes, others are just beginning to examine the opportunity of electronic processing, or are just
beginning to consider electronic processing for more sensitive transactions. In moving to electronic
processes, agencies face many important decisions. Among those decisions is one crucial question
of interest to the Department of Justice: When an agency converts each type of transaction to an
electronic−based process, how should the agency design that process so as to protect its legal
rights and minimize legal risks that may compromise the agency's mission? In accordance with the
OMB Guidance on GPEA, agency considerations of cost, risk, and benefit, as well as any measures
taken to minimize risks, should be commensurate with the level of sensitivity of the transaction.
Low−risk information processes may need only minimal safeguards, while high−risk processes may
need more. In the context of legal and litigation risks, "low−risk information processes" are those
that have a small chance of generating significant liability, financial impact, or litigation that would
have a significant effect on the agency. [1]
The many potential benefits of re−designing (or designing) agency processes to use
electronic−based processes are apparent: increased efficiency, accessibility, and reliability.
Advances in technology, public expectations, Congress's mandate in the GPEA, and Administration
policy all require that agencies of the United States move expeditiously to adopt electronic
processes. Some agencies are already seeing benefits from increasing their use of and reliance on
electronic recording and transaction systems. These benefits may not be fully realized unless the
agency designs its processes with care. This Guide explains the legal issues an agency is likely to
face in designing electronic−based processes (Part I), examines four overarching legal issues that
should be considered with respect to converting any given type of system or operation (Part II), and
discusses general and specific steps agencies should consider in converting to electronic processes
(Part III). The reader who already recognizes the legal issues presented by electronic processes
and those involved in replacing paper processes with electronic ones may wish to turn first to Part
229
III, which does not depend on the analysis of Parts I and II for an understanding of its suggestions.
In deciding whether and how to convert any given process from paper to an electronic one,
agencies should consider at least the following four issues, which are examined in Part II:
• Availability. Will the important information regarding a transaction be collected, retained, and
accessible whenever needed despite changes to computer hardware or software? How long
should the information be kept given legal record−keeping needs? The important transaction
information to be collected and accessible typically includes the content or substance of the
transaction (for example, the text of a contract); the processing of the transaction (such as
when and from where a communication was sent and when and where it was received); the
identities of the parties and the specific individuals involved in the transaction; and the intent
of the parties (such as whether they intended to enter into a binding contract).
• Legal Sufficiency. Certain types of transactions must be in "writing" and "signed" in order to
be legally enforceable. The law is still developing with respect to whether such requirements
will be satisfied by all electronic processes in all circumstances. By using electronic
processes that address the issues raised in this Guide, agencies can increase the likelihood
that their electronic transactions will meet such legal standards. Federal laws, such as
GPEA, address the legal validity and enforceability of electronic records and signatures.
GPEA states that: "electronic records submitted or maintained in accordance with
procedures developed under this title, or electronic signatures or other forms of electronic
authentication used in accordance with such procedures, shall not be denied legal effect,
validity, or enforceability because such records are in electronic form." E−SIGN similarly
provides that records relating to commercial, financial, or consumer transactions shall not be
denied legal effect solely because they are in electronic form or signed by electronic
signature. Although Federal activities are usually governed by federal rather than state law,
it is also noteworthy that various state laws, such as versions of the Uniform Electronic
Transactions Act (UETA) that are currently being introduced in the states, similarly address
the legal validity of electronic records and signatures, including in the formation of a contract.
UETA states: "a record or signature may not be denied legal effect or enforceability solely
because it is in electronic form…. [A] contract may not be denied legal effect or
enforceability solely because an electronic record was used in its formation."
• Reliability. Will electronic records be sufficiently reliable and persuasive to satisfy courts and
others who must determine the facts underlying agency actions? Will the electronic records
be maintained in such a way so as to satisfy admissibility requirements? Will sufficient
context be preserved so that the electronic records are usable?
• Compliance with Other Laws. Will the agency's use of electronic methods to obtain, send,
disclose, and store information comply with applicable laws such as those governing privacy,
confidentiality, recordkeeping, and accessibility to persons with disabilities? Myriad federal
laws govern the use and disclosure of information gathered by the federal government.
Agencies generally have developed systems for addressing such laws with regard to
paper−based information. Electronic processes also will have to be designed to allow an
agency to comply with such laws.
Part III of the Guide provides both general and specific steps an agency may take to reduce the
potential legal risks of moving to electronic transactions. The general steps include:
1. Conduct an analysis of the nature of a transaction or process to determine the level of
protection needed and the level of risk that can be tolerated;
2. Consider potential costs, quantifiable and unquantifiable, direct and indirect, in performing a
cost/benefit analysis;
3. Use available sources of expertise, such as legal, programmatic, and technical experts,
230
inside and outside your agency, including the OMB Guidance;
4. Consider developing a comprehensive plan when converting a traditional process to an
electronic one, especially if converting means re−engineering the existing process;
5. Consider the kinds of information relevant to the process and ensure that necessary
information is gathered;
6. Consider using a "terms and conditions" agreement;
7. Incorporate an appropriate retention and access policy for the records produced by
electronic processes, including long−term retention where necessary;
8. Be aware of legal concerns that implicate effectiveness of or impose restrictions on
electronic data or records;
9. Just as should be done with paper processes, document the various steps in your electronic
process so that you can demonstrate the reliability of your process to courts and others who
must determine the facts underlying an agency action;
10. Analyze the full range of technological options and follow commercial trends where
appropriate;
11. If an agency considers using an outside entity to manage information, the agency should
consider the various liability and privacy issues that may arise as a result of this system; and
12. Retain paper−based information in important or sensitive contexts where necessary.
The specific suggestions in Part III detail the types of information that should be gathered, retained,
and made available on demand. They also make recommendations that address particular agency
activities, including contracting, regulatory programs and other programs that require reporting of
information, and benefit programs.
Exhibit 1 provides key legal issues for agencies to consider in adopting an electronic process. The
exhibit is intended to serve as a resource for agencies; it is not a required checklist and it is not an
exhaustive listing of the possible issues such processes may raise. Exhibit 2 provides the names
and contact information for the attorneys who may be contacted should readers have specific
questions or comments about this Guide.
Exhibit 1: Key Legal Issues to Consider in Adopting an Electronic Process
This exhibit is provided as a resource for agencies to identify the legal issues to consider in
adopting an electronic process. There are two general ways of identifying the legal issues
associated with adopting electronic processes. One convenient approach is to consider the features
of an existing paper−based process, and decide how the electronic process must be designed in
order to provide the same functions. In the alternative, one can turn to first principles and seek to
identify legal issues without reference to any existing process. These two approaches may be
complementary; concerns that might be immediately apparent when one approach is used may not
be under the other approach. Accordingly, this exhibit incorporates elements of both approaches.
This exhibit focuses on legal issues associated with adopting an electronic process. (This analysis
has many features of a requirements analysis, which agencies might already be conducting as part
of their business process.) Although electronic processes can have many significant advantages
over paper processes, those benefits will not be addressed in detail as they are outside the scope of
this Guide. This exhibit also does not comprehensively address issues associated with archiving of
records; for a more detailed review of that topic, please consult the guidance prepared by the
National Archives and Records Administration. Although this exhibit is intended as a resource to
federal agencies, some agencies may conclude that other approaches are more appropriate in
addressing legal issues related to the development, use, and maintenance of those agencies'
electronic processes.
231
A. Comparison of Paper and Electronic Processes
1. What is the type or purpose of the process — is it a benefits application, a contract, a bid
proposal, a legally required report, or some other type of process?
2. What does each party to the communication need in order to achieve that purpose? This
may include dates, identities, intent, signatures, the sources of particular information, and
the informational content of the transaction itself. Who uses the information in your agency,
and for what purpose? Are there types of information that are needed only for certain narrow
purposes or only infrequently, but are very important for those purposes?
3. How will the electronic process collect this information?
4. What is it about the existing process that satisfies this need? A signature may serve a range
of purposes, including proving identity and intent, and deterring abuse. Likewise, mailing of
paper documents to a known address both helps to complete a transaction and helps to
confirm the identity of the other party to the transaction. How will the electronic process be
designed to meet these needs?
5. How do you ensure that information, once obtained, continues to be available when and
where you need it? How is information organized, stored, and retrieved? When is
information likely to be needed again, and for what purposes? How can appropriate
availability of information be assured in an electronic process?
6. What security procedures do you have, and why? Who has access to information and who
does not, and why? How can equivalent or better security be obtained in an electronic
process?
7. What elements of your program and process have historically been susceptible to fraud or
other abuse, and why? How do you deter these activities? How will you ensure similar or
greater deterrence in the electronic process? Will evidence of abuse be as available and
persuasive in the new system as in the old one? Are there any features of the electronic
process that are likely to facilitate fraud, abuse or disputes that did not occur before, or
conversely, that are likely to discourage such acts which have occurred in the past?
8. What do you do in your existing system to comply with applicable laws and regulations,
including any signature requirements, the Freedom of Information Act, the Privacy Act, the
Rehabilitation Act, discovery procedures, and confidentiality laws? How will you ensure that
you will continue to comply with those laws and regulations in your electronic system?
9. Have you adopted a plan to address the issues raised by moving to an electronic system,
and planned to consult relevant offices and agencies (including general counsels, inspectors
general, and relevant components of the Justice Department)?
B. Legal Issues Raised by Electronic Processes
1. Have applicable legal and practical requirements been considered?
♦ Is any information used in the process required by law or regulation to be in a
particular form, paper or otherwise?
♦ Is the transaction required by law or regulation to be "signed?" If so, how do you plan
to satisfy that requirement?
♦ Will your process comply with the Government Paperwork Elimination Act?
♦ What steps in the plan are taken to ensure confidentiality if confidentiality is
required?
♦ Will the process comply with:
◊ The Privacy Act?
◊ The Rehabilitation Act?
◊ The Freedom of Information Act?
232
◊ The Federal Records Act?
◊ Other requirements applicable to the agency's programs?
2. How necessary is the information?
♦ Is there a legal requirement to maintain the information?
♦ Is the information of importance to national security, public health or safety, public
welfare, the protection of the environment, or other important public purposes?
♦ How many people would be affected by the unavailability of this information?
♦ What is the importance of the information to the agency's programs?
♦ Could the information be used to collect money from the United States? Used by the
United States in collecting money? How much money is at issue in each individual
transaction? In the process as a whole?
♦ Does the information otherwise reflect rights or obligations of the United States or of
other parties?
♦ Might the information be needed for use in criminal proceedings? In other legal
proceedings?
♦ Is the information needed for proper agency management or for maintenance of
agency financial records?
♦ Is the agency confident that the information will not be needed in the future for any
important purpose?
♦ Is the information needed for any other reason?
If the foregoing analysis reveals that the information will not be necessary in the future and is
not required to be retained under applicable law, there is likely to be little need to consider
the risks associated with collection, use, and retention of the information discussed below. If,
however, the information is likely to be of legal significance, the agency may wish to
consider the following items in addressing potential risks. If the information is a "record,"
applicable law may nevertheless require it to be preserved in some form. Refer to guidance
prepared by the National Archives and Records Administration for more detail on this topic.
3. What are the risks that private parties will seek to commit fraud or otherwise misuse the
process?
♦ How much money or other benefits are at issue in each individual transaction? Can
transactions be aggregated?
♦ Is the transaction conducted with people with whom the agency has had a long−term
relationship?
♦ Is the program one with a history of fraud?
♦ Are there any other reasons to anticipate fraud in this process?
4. What are the risks that information will be damaged or lost?
♦ Will the information be stored in a way that is accessible in a timely fashion if it is
needed?
♦ Will the information be retrievable in a way that is easy to understand?
♦ What steps will be taken to control, log, and audit modifications to stored
information?
♦ How long will the agency need to keep its records?
♦ Is it appropriate to involve outside contractors in information management tasks?
♦ If so, does the contract and oversight process protect the interests of the agency and
the public?
♦ What plans are in place for migration of information when system technology is
upgraded?
♦ What parts of the process are unusual, distinctive, or unique to the agency? Do these
steps give rise to unusual risks of harm to stored information?
233
♦ Are there other risks?
5. Will the information collected be complete?
♦ Does an identity need to be associated with a transaction? How will identity be
proved?
♦ Does intent need to be associated with a transaction? Can the agency prove that the
person who transmitted the information understood its significance and appreciated
that his or her transmittal was legally binding on him or her?
♦ Does a signature need to be associated with a transaction? If so, what is the function
of the signature — identification, intent, evidentiary use, or some other function?
What is an appropriate electronic equivalent? Is a digital signature required, or will
some lesser form of electronic signature suffice?
♦ What information about the processing of the document (such as when a document
was sent or from where it was received) must be retained?
♦ Are documents ever modified upon receipt? If so, how is information (including
context, identity and intent information) regarding the modifications collected,
retained, and made available? How is this information segregated from information
associated with the original submission?
♦ Is there some other necessary legal element required to conclude the transaction
(delivery of a deed, for example)?
♦ What contextual information is necessary (e.g., the questions to which a set of stored
answers correspond)? How will it be collected and maintained?
♦ Is there any information that is used only infrequently, or only for one narrow
purpose, but that is nevertheless critical to the success of the system?
♦ What other information needs to be collected by virtue of the distinctive features of
the transaction?
6. Will the information be otherwise usable and credible for all necessary purposes, including
possible legal proceedings?
♦ Can the agency show that the information it received accurately reflects the
information that was intended to be transmitted?
♦ Can the agency show that the information it possesses accurately reflects the
information originally submitted to it? Is the original information available as well as
any subsequent edits?
♦ Is a "terms and conditions" agreement appropriate? Is the information retained
sufficient to be persuasive to a judge, jury, or other third party? Does it provide
simple, straightforward and corroborated evidence of what occurred?
♦ Has the agency addressed any other potential obstacles to the use of the information
in a legal proceeding?
7. Have all relevant offices and agencies been consulted? Potentially interested offices and
entities may include:
♦ Agency program offices
♦ Agency information technology specialists
♦ General Counsel's office
♦ Inspector General's office (audit and investigative personnel)
♦ Records management personnel
♦ FOIA, Privacy Act, and civil rights officers
♦ Agency enforcement personnel
♦ Other agency personnel
♦ Office of Management and Budget
♦ The Department of Justice
234
♦ National Archives and Records Administration
♦ Other government offices or agencies (federal, state, local and tribal) that are
involved in the process, use the resulting information, or otherwise have a stake in
process design
♦ Private and non−governmental organizations, including as appropriate contractors,
the regulated community, and representatives of the general public
8. Have you developed a plan to address the foregoing issues?
♦ Does the plan assign responsibility for particular tasks or problems to specific offices
or individuals?
♦ Does the plan provide for any auditing of the process, including auditing of any
outside contractor who manages information on behalf of the agency?
♦ Does the plan provide for periodic reassessment?
♦ Have you consulted with interested parties on the development of this plan?
♦ Have you shared the final plan with interested parties?
Exhibit 2: Contact Information, Department of Justice
Electronic Commerce Working Group Co−Chairs
• David Goldstone (Co−chair)
♦ Computer Crime and Intellectual Property Section, Criminal Division
(202) 514−1026
(202) 514−6113 fax
E−Mail:
• Chris Kohn (Co−chair)
♦ Director, Corporate/Financial Litigation Section, Commercial Litigation Branch, Civil
Division
202−514−7450
202−514−9163 fax
E−Mail:
Electronic Processes Subgroup
• Tony Whitledge (Chair)
♦ Criminal Appeals and Tax Enforcement Policy Section, Tax Division
(202) 514−2832
(202) 305−8687 fax
E−Mail:
• David Goldstone
♦ Computer Crime & Intellectual Property Section, Criminal Division
(202) 514−1026
(202) 514−6113 fax
E−Mail:
• Joan Hartman
♦ Fraud Section, Commercial Litigation Branch, Civil Division
(202) 307−6697
235
(202) 616−3085/9029 fax
E−Mail:
• Brian Kennedy
♦ Federal Programs Branch, Civil Division
(202) 514−3357
(202) 616−8470 fax
E−Mail:
• Sylvia Liu
♦ Policy, Legislation, and Special Litigation Section, Environment and Nat. Res.
Division
(202) 305−0639
(202) 616−8543 fax
E−Mail:
• Ken S. Nakata
♦ Disability Rights Section, Civil Rights Division
(202) 307−2232
(202) 307−1198 fax
• Marc Gordon
♦ Land Acquisition Section, Environment and Natural Resources Division
(202) 305−0291
(202) 305−8273 fax
E−Mail:
• David Gottesman
♦ Corporate/Financial Litigation Section, Commercial Litigation Branch, Civil Division
(202) 307−0183
(202) 514−9163 fax
E−Mail:
• Jennie Plante
♦ Executive Office for United States Attorneys
(202) 616−6444
(202) 616−6647 fax
E−Mail:
• Richard Phillips
♦ Federal Programs Branch, Civil Division
(202) 514−4778
E−Mail:
• Justin Smith
♦ Policy, Legislation, and Special Litigation Section, Environment and Natural
Resources Division
(202) 514−9369
(202) 514 4231 fax
E−Mail:
236
[1]
For example, even small transactions that take place in great volume could expose the agency to
a large overall risk, even though each particular transaction does not.
Introduction
Under the Government Paperwork Elimination Act (GPEA), Pub. L. No. 105−277, §§1701−1710
(1998) (codified as 44 U.S.C.A. § 3504 n. (West Supp. 1999)), Federal Executive agencies [2] are
required, by October 21, 2003, to provide for (1) "the option of electronic maintenance, submission,
or disclosure of information, when practicable, as a substitute for paper," and (2) "the use and
acceptance of electronic signatures, when practicable." The Office of Management and Budget
(OMB) has developed guidance to assist agencies in implementing GPEA's requirements.
"Procedures and Guidance; Implementation of the Government Paperwork Elimination Act," 65 FR
25508, May 2, 2000 ("OMB Guidance"). As part of the OMB Guidance, the Department of Justice is
charged with developing, in consultation with federal agencies and OMB, practical guidance on
legal considerations related to agency use of electronic filing and recordkeeping. The purpose of
this Guide is to identify legal issues that agencies are likely to face in converting to electronic
processes and to provide some suggestions on how to address them. Agencies should also
consider the significance of the "Electronic Records and Signatures in Global and National
Commerce Act" (E−SIGN) (Pub.L. 106−229, § 1, June 30, 2000, 114 Stat. 464, codified at 15
U.S.C. §§ 7001 — 7006), although a detailed discussion of that statute's impact on the federal
agencies is beyond the scope of this Guide.
The rise of electronic commerce offers agencies exciting opportunities to convert — or redesign —
paper−based processes to electronic ones. While some agencies have experience using electronic
processes, others are just beginning to examine the opportunity of electronic processing, or are just
beginning to consider electronic processing for more sensitive transactions. In moving to electronic
processes, agencies face many important decisions. Among those decisions is one crucial question
of interest to the Department of Justice: when an agency converts each type of transaction to an
electronic−based process, how should the agency design that process so as to protect its legal
rights and minimize legal risks that may compromise the agency's mission?
In accordance with the OMB Guidance on GPEA, agency considerations of cost, risk, and benefit,
as well as any measures taken to minimize risks, should be commensurate with the level of
sensitivity of the transaction. Low−risk information processes may need only minimal safeguards,
while high−risk processes may need more. In the context of legal and litigation risks, "low−risk
information processes" are those that have a small chance of generating significant liability, financial
impact or litigation that would have a significant effect on the agency. [3]
The many potential benefits of re−designing (or designing) agency processes to use
electronic−based processes are readily apparent: increased efficiency, accessibility, and reliability.
Some agencies are already seeing benefits from increasing their use of and reliance on electronic
recording and transaction systems. Yet, these benefits may not be fully realized unless the agency
designs its processes with care. The collection and management of electronic records is becoming
increasingly important for federal agencies.
Agencies must electronically receive, transmit, and store information in ways that will be acceptable
to their program participants and others, while not violating legal restrictions, jeopardizing the
government's legal rights, or unduly exposing the government to liabilities, criminal acts or other
waste, fraud or abuse. The shift away from paper−based records raises serious record collection,
management and retention issues, some of which are familiar to the world of paper records and
some of which are unique to electronic record retention and retrieval. On the other hand, electronic
records can offer benefits, like easier search and retrieval, that may reduce some of the problems of
237
paper−based records management. Thus, the objective of any conversion to electronic processes is
to maximize the benefits that such systems can offer, while simultaneously minimizing any risks,
including legal risks.
The term "electronic processes" includes any use of computers or other electronic devices to
conduct transactions or business, to store data or records, or to transmit communications or
information (whether text, voice or visual images). Electronic processes encompass not only the
hardware and software applications, but also the personnel, procedures, and policies that make the
system work properly.
This Guide raises issues that agencies should consider in deciding when each of their processes
and functions should be partially or entirely converted to an electronic process and how such
electronic processes should be designed in order to reduce legal risks that may be identified. The
first two parts of this Guide discuss the importance of the legal issues to the conversion process and
explore the issues that electronic processes present to the agencies. The last part provides a list of
suggested steps that agencies may incorporate into their decision−making process to address the
issues raised in Parts I and II. The reader who already recognizes the legal issues presented by
electronic processes and those involved in replacing paper processes with electronic ones may
wish to turn first to Part III, which does not depend on the analysis of Parts I and II for [an]
understanding of its suggestions. [4]
This Guide is intended only to provide information and analysis to the Department's client agencies.
It is intended only to assist those agencies in identifying general issues in process design and is not
intended to provide binding rules or standards for the use of electronic processes. The Department
anticipates that agencies will exercise their own discretion in determining how to address the issues
discussed in this Guide. Nothing herein is intended for use in resolving particular cases or to confer
any right on any person or group. See, e.g., United States v. Caceres, 440 U.S. 741 (1979). The
function of providing opinions and legal advice to executive agencies is conferred by regulation on
the Office of Legal Counsel. 28 C.F.R. §0.25 (1999). To the extent that an agency seeks the legal
opinion of the Department of Justice regarding these matters, we recommend that the agency
contact the Office of Legal Counsel.
[2]
GPEA, Section 1710(2), refers to 5 U.S.C. 105, which provides: "For the purpose of this title,
'Executive agency' means an Executive department, a Government corporation, and an
independent establishment."
[3]
For example, even small transactions that take place in great volume could expose the agency to
a large overall risk, even though each particular transaction does not.
[4]
Further information on the topics discussed in this Guide may be obtained by contacting the
lawyers whose names appear in Exhibit 2.
I. Why Agencies Should Consider Legal Risks
Government agencies are enmeshed in law: they are creatures of law; they act pursuant to legal
authority; they are bound to carry out legal duties in a way legally accountable to the public; and
they are subject to special restrictions imposed by law. For example, government procurement
processes are regulated by law. Over time, agencies have developed processes to respond to
obligations and practices imposed by these responsibilities. Therefore, agencies should be aware of
the legal implications of converting or re−engineering existing processes and the legal changes that
can occur in the move from traditional to electronic processes. [5]
Advances in technology, public expectations, Congress's mandate in GPEA, and Administration
policy all require that agencies of the United States [G]overnment move expeditiously to adopt
electronic processes. As this Guide explains, it is important to consider carefully the legal
238
requirements and risks associated with the process involved. In many cases, the legal aspects of
the process may be apparent and adopting an electronic process may be comparatively simple. In
others, designing an electronic process that adequately protects an agency's ability to carry out its
programs and legal obligations, and that deters fraud and misconduct by private parties, may be
more difficult. In such cases, adopting electronic processes may require a substantial and long−term
commitment of agency staff and resources, including close involvement at an agency's highest
levels.
Finally, we note that our comparisons in this Guide of electronic processes to paper systems should
not in any way be taken as an endorsement of the continued use of those paper processes. Rather,
because everyone is familiar with paper systems, we refer to those systems to assist agencies in
issue−spotting as they develop their electronic processes. [6]
A. Legal Issues Involved in Conversion to Electronic Processes
Agencies keep records for several reasons: to carry out their public responsibility to conduct agency
business with due care in a fiscally responsible manner, to meet statutory recordkeeping
requirements, and to provide the information necessary to protect the government's interest when
disputes arise over agency operations. Paper−based systems of records have evolved over time to
satisfy those needs. Many of those systems are being replaced by electronic processes that are
being deployed over short time periods. Often, problems arise because the re−engineered process
does not fully capture the needs of the agency. As a result, the adoption of electronic systems, or
the conversion of paper−based records systems to electronic ones, can present significant legal
issues that need to be identified and addressed as part of the decision−making process. New legal
issues may arise from the use of the new storage media and the new electronic mechanisms that
allow agencies to conduct business and deal with the public in a manner that was not possible in
the paper world. On the other hand, other legal issues may be reduced with an effective electronic
process. For example, the use of a digital signature on a document can cryptographically bind the
signature to the entire document, whereas a written signature on the last page of a such a
document may leave questions as to which of the preceding pages are part of the signed document.
Electronic processes can be designed in such a way that the electronic transactions and their terms
can be recorded in a legally adequate manner. For example, an agency can design its electronic
processes so that program participants can readily ascertain when they become eligible for benefits
and the agency can establish that program participants agreed to certain limitations on the agency's
obligations. Even if it is determined that some legal obligations cannot be established electronically,
perhaps most of the program's business can be conducted and recorded electronically if just a few
crucial paper instruments are used and saved.
B. Identifying Legal Issues
At this point, no one can provide definitive guidelines as to what program safeguards will ultimately
be necessary to protect an agency's interests and create binding and enforceable obligations on the
agency and those with whom it does business. What we can say, however, is that agencies should
attempt to understand which risks have increased and which have decreased through the adoption
of electronic processes. If agencies incorporate within their processes mechanisms to account for
those risks, they will be far less likely to be surprised by unfavorable rulings than an agency that
simply converts paper systems to electronic ones without undertaking such an analysis. The act of
addressing these risks will give agency decision−makers a better understanding of the differences
between paper and electronic processes and put them in a better position to design and implement
electronic systems that will preserve the strengths of paper processes while avoiding the
weaknesses inherent to paper and the flaws that have been incorporated into the paper systems
239
over the years.
A key question agencies face in converting to or adopting electronic processes is whether the
system under consideration meets the applicable legal requirements and provides adequate
evidence of its transactions and actions. In certain situations, an agency may determine that an
electronic process is "good enough" to meet its legal needs without regard to whether it is
comparable to or as good as its prior process. At the other extreme, some agencies may decide that
electronic conversion will require a complete re−engineering of their business processes in order to
address the legal risks and issues that a particular system presents or that are not being addressed
as effectively in their existing system.
Because most of our common experience and legal precedent comes from the paper−based world,
many agencies will use their existing paper−based systems as a reference point in their analysis.
So long as agencies recognize that most paper processes have risks associated with them, they
may wish to consider whether the new systems will work at least as well as the traditional ones, and
consider the significance of the risks posed by their conversion. The discussion that follows
compares some aspects of paper systems to electronic processes as a method to identify legal
issues that need to be considered in designing electronic processes. No disparagement of
electronic processes, nor praise for paper ones, is meant by this analytical device.
Well−designed paper systems have advantages: paper records are more or less permanent;
alterations usually can be detected; important contextual information may be added as the paper is
processed; access to documents often can be controlled easily; many documents can be preserved
for long periods of time and remain readable without special equipment; and there are well−settled
rules that have developed over time to address issues such as the validity, authenticity, and
reliability of paper documents. But paper also has limitations: storage of paper documents
consumes vast amounts of space; single documents may easily be lost or become irretrievable;
access is limited to those having physical possession of the document or a copy; extracting
information from multiple paper sources is difficult and time−consuming; search capabilities are
limited; some paper deteriorates and can become unreadable within a few years; and paper is bulky
and difficult to transport in large volumes. By contrast, effective electronic processes can overcome
some of paper's weaknesses: electronic records, when properly organized or archived, are easier to
store, search, and retrieve than paper and allow for much broader access than paper documents.
An example describing both an agency's traditional process and its electronic process serves to
illustrate this point. Suppose that an agency program involves transactions with an individual, and
that the agency receives data about the transaction not only from the individual participant (e.g., an
application form, financial statements), but also from other sources (e.g., agency personnel's reports
on the transaction). In the traditional paper−based system, the agency probably would have kept a
file with the specific paper documents submitted by each source (e.g., the paper application form
and financial statements from the participant, and internal reports from agency staff). If a dispute
ever arose that required a determination of who submitted what information, the paper documents in
the file probably would reflect the needed information. (If the system were flawed, however, misfiled
paper documents might not be retrievable at all.) A well−designed electronic process should
ordinarily be able to provide the same information as the paper system: who submitted the
information; what information was submitted; when the information was submitted; and whether all
the relevant information was retrieved.
Agencies traditionally file paper communications by subject or by a name of a person or entity. The
challenge in such a system is to ensure that all communications are properly filed in the appropriate
place. When such a system works properly, agency employees (and the lawyers who represent the
agency) have a permanent record (typically arranged chronologically) of all the significant
240
documents pertaining to the matter. When it does not, documents may be irretrievably lost through
misfiling. Electronic documents, on the other hand, may be maintained in a way that uses identifiers
to associate the documents with a particular matter or "file," which often allows for easier access.
However, for certain types of electronic records systems, processes and procedures must be
developed to address such issues as creating accurate and correct associations in the electronic
files, ensuring that each document is maintained in an unaltered state, and identifying the source,
date, and content of additional information added. [7]
C. Assessing the Significance of the Risk
An agency that routinely found itself able to enforce its programmatic requirements when they were
embodied in written documents could face significant problems if it converts to an electronic process
that does not capture information legally sufficient to enforce its interests. The full scope of agency
operations can be affected by the government's ability to litigate successfully any disputes involving
agency programs and operations. The outcome of litigation can dictate whether an agency can:
• Collect money owed it on various loans, grants or other debts;
• Enforce security interests it received to secure various financial transactions and thereby
protect a lending or granting program;
• Enforce important regulatory requirements;
• Continue to interpret its program, statute or regulations in accordance with current practices;
• Enforce contracts with third parties that are necessary for the successful running of its
programs or mission; or
• Avoid unintended liabilities.
To be able to protect the government's interests in litigation, the Department of Justice needs
available, reliable, and persuasive agency records: records that are complete, uniform, easily
understood, easily accessible and have been kept under a system that ensures a chain of custody
of submissions and information gathered from all sources. Those requirements will not disappear
merely because the medium of transactions changes from paper to electronic.
Even relatively infrequent litigation can have a very substantial impact on an agency. A government
victory in a single case may provide binding precedent that approves an agency practice or
establishes the validity of agency regulations. Conversely, a loss in a single case might establish
adverse precedent that rejects an agency practice or even invalidates an agency regulation. The
agency may be able to seek a different result in future cases, but an initial loss may generate
precedent that will affect the outcome of those cases, and may open the door to litigation by other
parties who might not even have been aware that an argument was available. Even disputes and
litigation over monetary claims against an agency may establish controlling interpretations of
statutes and regulations. On the other hand, agencies should note that for transactions that an
agency determines have low risk of being involved in litigation and that involve low financial risk,
many of the considerations described in this Guide may not apply.
Moreover, while criminal prosecutions and civil fraud cases involve a relatively small number of
transactions within any given agency, such actions are critical to the integrity of agency programs
because they serve to deter others from engaging in similar conduct. When an agency does not
have a credible deterrent to fraud through vigorous detection and prosecution policies, fraud
typically increases dramatically. Without effective and successful litigation on the agency's behalf,
fraud in agency programs may increase and legal challenges to agency actions could have a
greater chance of success. Essential to such litigation is the consistent accuracy and reliability of an
agency's recordkeeping system, whether paper or electronic.
241
Finally, agencies must be able to satisfy a variety of people besides judges and juries. Agencies are
accountable to the public, customers, auditors, and Congress, and may have varying legal
obligations to each. Electronic processes sufficient to protect an agency's position in court should
also be able to address any legal responsibilities to these other audiences just as well−designed
paper processes.
[5]
The term "electronic process" is intended to encompass all systems in which records may be
created or stored in electronic form as part of the agency's overall electronic process. These
systems may or may not fall within the strict definition of an "electronic recordkeeping system," as
defined by the National Archives and Records Administration. See 36 C.F.R. §§ 1234.2, 1234.22
(1999). Adherence to laws governing federal records is one of the legal considerations involved
when agencies convert to electronic systems.
[6]
By the same token, we do not mean to imply that all existing paper systems are well designed (or
indeed even capable of being designed) to eliminate such risks, or that well−designed paper
systems are always properly implemented. That this Guide does not elaborate at length on
problems with some paper transaction systems is due, in short, to its focus on electronic systems
rather than any belief that paper systems are always adequate to satisfy agency needs or legal
requirements.
[7]
As electronic mail ("e−mail") becomes a more common means of official communication and
deliberation concerning agency actions, an agency's e−mail records will become a more significant
repository of significant information reflecting agency deliberations, actions and decisions. Where an
agency elects to preserve e−mail records electronically, the agency should design its electronic
processes properly from the outset, to ensure that its e−mail system has appropriate mechanisms
for capturing and storing those e−mail messages that ought to be a part of the official record.
II. Legal Issues to Consider in "Going Paperless"
As an agency identifies processes for conversion from paper to electronic, the agency should ask
how it should design those processes so as to protect its legal rights and minimize legal risks that
may compromise the agency's mission.
In answering these questions, agencies should consider the following four issues:
1. Will the electronically gathered and stored information be collected, retained, and accessible
whenever needed?
2. Will the electronic collection, transmission, or storage of "documents" or information comply
with applicable legal requirements, including, for example, laws requiring that certain records
be maintained in a particular form or format?
3. Will electronic records be sufficiently reliable to be useful to Congress, agency
decision−makers, private disputants, judges, juries, and others who must determine the facts
underlying agency actions?
4. Will the agency's use of electronic methods to obtain, send, disclose and store information
comply with applicable laws, such as those governing recordkeeping, privacy, confidentiality,
and accessibility?
Our discussion of each of these issues is an attempt to assist the agencies in spotting relevant
issues; this discussion is not intended to provide authoritative answers or to endorse any particular
technology.
A. Availability of Information
To ensure the availability of information in an electronic process, agencies should ensure: (1) that
an electronic process collects all relevant information; (2) that the information is retained properly;
242
and (3) that the information is readily accessible. The potentially lengthy period of time between the
collection of information and its use in many situations, including litigation, highlights the importance
of these issues.
Most agencies now file and retain significant paper documents themselves. Some agencies
converting to electronic processes have considered requiring the party that submits electronic
information to retain the original form and source documents relating to the filing, perhaps in paper
and perhaps electronically. Other agencies, recognizing the technical complexity of electronic
records management, may hire contractors to maintain the information and provide more than
ministerial support. If agencies rely on the people or entities submitting information to retain legally
significant documents, they might find some of those documents unavailable if a dispute over the
transaction arises. Similarly, if an agency uses an outside information manager, it should
contractually ensure that its information is properly retained and that the agency has access to its
own information. In either case, the agency should take appropriate steps to ensure that information
in third−party hands is available when needed.
1. Will the Electronic Process Gather Necessary Information?
Agencies should carefully examine the processes that they will be converting to electronic
processes, and determine what information must be collected from each transaction. In adopting
electronic processes, agencies should ascertain whether the following four specific types of
information should be captured and retained: (1) content of the transaction, including all records that
comprise the substance of the transaction or filing; (2) records that contain information about how
the transaction was processed, including dates received and changes or modifications that were
made in records; (3) a means to authenticate the identity of all people who participated in the
transaction both inside and outside the agency, and the scope of each person's participation; and
(4) for appropriate transactions, a means for establishing the intent of the participants to enter into
the transaction or agreement. See also, e.g., Public Citizen v. Carlin, 184 F.3d 900, 910 (D.C. Cir.
1999) (discussing preservation of content, structure, and context of federal records).
Information gathering issues can be demonstrated through the following example:
An agency operates a direct loan program. Formerly, the agency received loan applications on
paper, but now receives them electronically through its Web site. Four applicants (Abel, Baker,
Company and Donald) submit loan applications that contain materially false and misleading
information. When challenged by the agency, Abel, Baker, Company and Donald offer the following
excuses:
• Abel claims that he sent his application along with an explanatory electronic note that
concerned key information on his application.
• Baker claims that he submitted truthful information, and that someone must have altered it
after he sent it.
• Company, a large corporation, claims that no employee was authorized to apply for a loan,
so a rogue employee (identity unknown) must have sent the application without the
company's knowledge. The agency's electronic process does not show who or even what
office at Company submitted the application.
• Donald claims he was only working on a draft application with only preliminary information
that he never meant to send, and that he must have pushed the "enter" button by accident,
thus unwittingly transmitting his "draft" as though it were a real application.
Does the agency's electronic process provide adequate safeguards, just as paper processes must,
to refute the arguments raised by Abel, Baker, Company and Donald?
243
Content
When agencies collect information in paper form, additional information beyond that requested by
the four corners of the form is frequently supplied. The document received by an agency might
include additional attachments not necessarily required, and the agency might supplement the
record with interlineations or notes. The physical composition of the document can attest to its
completeness — for example, pages that were stapled together by the sender suggest that this was
the document that was intended to be submitted to the agency. The agency's electronic process
should include safeguards so that an agency can establish all of the information that was submitted
by the sender as a single electronic document.
In the above example, the agency's electronic process should be designed in such a way that the
agency can demonstrate that Abel's submission included only the application form and no attached
electronic note or other information. In a paper system, the agency would point out that it has
standardized its filing procedures in a way that ensures that all attachments are saved with the
documents. (Of course, this presumes that the agency has such standards.) Abel would be faced
with convincing the agency or a court that he did, in fact, include an attachment to his filing. In the
electronic as in the physical world, the agency must also be able to show that its processes have
been designed to capture entire communications and that its files contain everything that it received
from Abel.
Processing
Agencies should also ensure that their electronic processing captures all relevant information, such
as when and where the document was sent and received and whether the document was
subsequently altered, and, if so, the source, date, and content of the alteration. Electronic systems
can be designed to capture such information, including alterations or changes to a document. In the
above example, if the agency's electronic process reliably kept track of all alterations to the
applications after receipt, it could prove that Baker's application was not altered.
Identities
Often it is crucial to be able to prove who (i.e., a specific individual) submitted a communication or
agreed to a transaction with an agency. Paper documents generally accomplish this fairly well, most
commonly by containing a handwritten signature that can be matched with a specific person, a
letterhead or return address on the document or envelope, and so on. Some transactions are so
important that agencies require a personal appearance before some designated official in order to
establish identity, e.g., having a notary endorse or certify the signature.
Agencies should consider whether, in appropriate circumstances, a proposed electronic process will
gather information sufficient to identify the person who submitted a communication or agreed to a
transaction. For important transactions, particularly those that require proof of an individual's
identity, or that he or she is creating a legally binding obligation, an agency may wish to require
those individuals to employ some form of electronic signature. In the above example, the use of a
digital signature could provide the agency a reliable means of identifying the name, position, and
location of the specific individual who submitted the document, and thus, it would be difficult for
Company to deny that one of its employees filed the application. See the discussion below in
Section II.B.2 regarding the legal significance of signatures.
Intent of the Parties
Enforcement of an agency's rights often depends upon being able to prove what was intended by a
communication. Did the parties intend a transmission of information to be a draft of a possible
contract or a final, legally binding contract? Did an individual who transmitted information to the
244
agency intend it to be a formal report which, if false, could result in his criminal prosecution?
Paper−based transactions and communications typically answer such questions in a number of
ways, for example, by whether a document "looks" like a contract or just an informal letter, whether
it contains a handwritten signature, or whether it contains a warning that it is submitted under
"penalty of perjury." Similar methods can be used in the electronic world.
The agency could probably defeat Donald's argument in the above example by showing, for
example, that (1) its electronic process would not allow an application to be transmitted unless
Donald had clicked "yes" after being shown a message explaining that by doing so, he was
submitting a final application upon which the agency would rely; (2) it had provided a telephone
number or e−mail address for Donald to notify the agency that an application had been submitted in
error; or (3) the agency had actually notified Donald that it had received his application. [8]
2. Will the Information Be Retained?
Audits, Congressional inquiries, litigation and other dispute resolution often take place years after
the agency's acts and transactions occurred and the "files" are considered closed. But such
information remains essential to the agency's abilities to protect its program and to the ability of the
Department of Justice to investigate and litigate the agency's cases. Information no longer
necessary for day−to−day operations also may be useful to the agency itself (for example, when
agencies update procedures and revise regulations). Additionally, different types of information
require different levels of retention. Thus, agencies should determine which information should be
retained and for what period of time, as well as which information may be discarded soon after
receipt.
Electronic systems should be designed and maintained to guard against data corruption, whether
through accidental deletion, equipment failures, storage media deterioration over time, stray
electromagnetic forces, or myriad other hardware and software problems. Such systems should
also be designed to limit access to authorized users — for example, by requiring controlled
password identification for access to certain information. Finally, an electronic system should be
designed to ensure proper file retention and tracing of alterations and updates (as to source, date,
and content, and all other internal controls that are required to produce a secure and reliable record
maintenance and retention system). [9]
Electronic data are frequently transferred or converted from one storage medium or software
system to another. In this process (sometimes referred to as "data migration"), important
information, such as formatting and the structure and content of electronic forms, may be lost, or
even the record itself destroyed unless appropriate steps are taken. Similarly, unless such changes
are thoroughly documented, it can be difficult to demonstrate that the critical information was not
changed in the process. In transition between systems, agencies sometimes maintain multiple,
overlapping systems, particularly in the transition from paper to electronic based systems. Because
information from all systems may be required to be maintained under the Federal Records Act, [10]
and may be needed for various purposes, agencies should address retention issues for all systems,
even overlapping ones.
3. Will the Information Continue to be Accessible?
Unlike paper files which, when properly organized and maintained in the ordinary course of
business, are readily available and usable without any special equipment, electronic information is
not always accessible without special equipment and software. Agencies should consider several
factors related to the accessibility of electronic records. First, computer technology is rapidly
changing and software and formatting standards may quickly become obsolete. Computer−stored
data may become useless unless the agency can provide the continued capability with the older
245
technologies or can accurately translate the document as more modern systems are implemented.
Second, if in the future, an agency no longer has staff who are familiar and competent to work with
the electronic processes necessary to read older data, such data could be functionally unavailable.
[11]
Electronic files might be stored while encrypted by software or protected by passwords no longer
available or remembered years later, unless steps are taken to preserve the software or passwords.
As noted above, these concerns are no less serious if the information is held by an outside party.
B. Legal Sufficiency of Electronic Records
Various state and federal laws require that certain types of transactions or events be reflected by
written or signed documents. Case law and other legal authorities offer some guidance as to what
types of transactions are covered and what types of records satisfy such requirements. GPEA
addresses this situation by providing that electronic records and signatures shall not be denied legal
effect because they are in electronic form. The recently enacted E−SIGN legislation contains similar
provisions as to certain transactions, but a discussion of its provisions is beyond the scope of this
Guide.
1. The Importance of Writings
In many circumstances, the law requires that the terms of an agreement or other legal obligation be
in "writing." [12] The essence of the "writing" requirement is to establish a record that is not subject to
imperfect memory or to competing claims as to what parties to an agreement intended. The formal
requirement that legal documents be reduced to "writing" has been justified on many bases,
including: providing the type of ceremony needed to make the parties appreciate the fact that they
are undertaking enforceable legal obligations; creating evidence that the legal instrument exists and
was entered into; simplifying litigation by narrowing the scope of relevant evidence; and providing
evidence more permanent than a witness's recollection.
A statutory "writing" requirement does not necessarily imply that this writing must be on paper.
Indeed, E−SIGN and GPEA may limit the courts' authority to restrict the term "writing" to paper
documents. But the functional purposes underlying a "writing" requirement are important, and courts
might require that these purposes be satisfied (whether through interpreting the term "writing" or in
some other fashion) whether a document is on paper or is in electronic form. Electronic documents
that satisfy the purposes of the "writing" requirement should be acceptable to the courts so long as
they have the same (or better) indicia of reliability as their paper counterparts. Thus, electronic
documents that provide a documentary recording of a transaction in a manner that establishes and
memorializes the terms should constitute a "writing." To the extent that an electronic document is
more like a traditional "writing" than an oral agreement, it should be treated by the law similarly to a
paper document. [13] The challenge in creating electronic documents is to ensure that disparate
communications (such as exchanges of e−mail) are reduced to a single document in a manner that
provides evidence that the parties understand that the document memorializes the underlying terms
and conditions. Electronic documents that satisfy those purposes are more likely to be given legal
effect.
Federal and state laws traditionally have required that many types of documents, particularly
contracts, [14] be in writing and signed by the parties to be bound. State laws known as the "Statute
of Frauds" also require many contracts be written. [15] See Restatement (Second) of Contracts § 110
(1979). [16] Many states have introduced amendments that relate to electronic contracts, and these
amendments are likely to have an impact on the "writing" and "signatur e" requirements contained in
state statutory codes.
A federal statute, 31 U.S.C. §1501(a)(1)(A) (1994), provides that United States government
obligations may be enforced "only when supported by documentary evidence of … a binding
246
agreement between an agency and another person (including an agency) that is … in writing, in a
way and form, and for a purpose authorized by law." As of the date of this Guide, no federal court
has construed this writing requirement in the context of electronic commerce nor has a court
squarely addressed the question of whether a purely electronic record, created as part of an
automated system, would alone meet the Statute of Frauds. [17] However, case law and other legal
authorities offer limited guidance as to whether federal and state statutes of frauds or other statutory
requirements of writings will be satisfied by electronic substitutes. The Comptroller General has
concluded, for example, that contracts formed using some electronic technologies may constitute
valid obligations of the government for purposes of 31 U.S.C. §1501, so long as the technology
used provides the same degree of assurance and certainty as traditional "paper and ink" methods of
contract formation. [18]
As to state statutes, many state statutes of frauds do not define "writing." However, courts have
accepted electronic communications that result in a paper document at the end of the
communications process, such as a telegram, as a "writing." See, e.g., Hillstrom v. Gosnay, 614
P.2d 466 (Mont. 1980). [19] To the extent that the electronic process clearly records the terms of
agreements and is adequate to show that the parties intended to make those agreements — that is,
they serve the purposes that the law has required and relied on paper to serve — it is more likely
that they will be accepted by the courts. [20]
Many court systems will themselves soon be allowing electronic filing of formal pleadings and briefs.
As courts become more familiar with electronic records through electronic filings, they presumably
will become more likely to recognize the validity of records and agreements recorded solely in
electronic form in sensibly implemented electronic recording systems. Courts, however, might be
reluctant to interpret legal requirements liberally merely because of technological advances, and the
risk that courts may lag in doing so cannot be discounted altogether.
2. The Importance of Signatures
Signatures have been given a unique place in the law partly because they reflect physical
characteristics of individuals that were applied to the particular document at issue. Generally, the
presence of a signature on a document is sufficient to identify the person who signed the document
(although courts might require that someone identify the signature as belonging to the signor), to
indicate that the person read and was familiar with the contents of the document (or at least had the
opportunity to read it before she signed it), and to demonstrate that the person agreed and intended
to be bound by the contents of the documents she signed. [21] These may be only assumptions, but
agencies, businesses and the courts routinely rely on them. [22] Such "presumptions" provide a set
of rules for associating an individual with a document and establishing his or her intent to accept or
acknowledge its contents. Many of those rules are supported by centuries of case law and, in some
cases, statutes that enforce them. Of course, signatures can be forged, may be illegible, or may
have been placed on a document in a manner that does not satisfy the rules. In those situations, the
party challenging the signature generally has the burden to rebut or overcome the presumption.
Unlike traditional signatures, electronic alternatives do not yet necessarily enjoy the long history of
use and common expectations that surround traditional signatures. However, other steps have been
taken — and undoubtedly more will be taken in the future — to support the validity of electronic
signatures. For example, an increasing number of statutes and regulations impose the same
presumptions of identity, intent, or familiarity with content that are typically associated with paper
signatures. The proper design of legal instruments can reduce the need for such presumptions.
Until such presumptions become widely accepted for electronic signatures, agencies should ensure
that the electronic signature technologies they adopt identify the signers of the document and
clearly express their intent and familiarity with the document.
247
For example, statutes that require certain agency officials to authorize or approve an agency action
might not be satisfied with something less than a signature on a document. Thus, simply affixing a
"/s/[Named Official]" on an electronic document authorizing a particular agency action may not
satisfy any requirement that agency actions be authorized in a signed writing by the appropriate
official, any more than it would on a paper document. The official's signature on a paper
authorization demonstrates that the official saw and signed the authorization; the law presumes that
the official was aware of the contents and the effect of signing the document. To the extent that an
agency adopts electronic processes for such approvals, it must ensure that the technology utilized
provides a legally acceptable method for indicating approval of the action.
3. Electronic Alternatives to Traditional Signatures
Electronic signatures generally fall into three broad methods of identifying an individual: something
the individual knows, something the individual possesses, and something about the individual.
Examples of techniques that use these methods include user identification codes and passwords
(i.e., numbers or codes known to the individuals such as a "PIN," a passcode, or a private key used
to make a digital signature [23] ), tokens, smart cards or other physical objects that the user
possesses that may be inserted into a reading device, and devices that measure physical, or
"biometric," [24] characteristics of the individual. [25] The National Institute of Standards and
Technology has recognized that use of a combination of authentication techniques can
"substantially increase" the security of an authentication system. For example, public key digital
signature technology is designed to work only when the private key which is used to make a
signature is used in conjunction with the proper PIN, password, or biometric identifier. [26]
Properly implemented, various types of electronic signatures, like traditional signatures, can offer
increasing degrees of reliability, although no system — either electronic or traditional — can
completely prevent fraud or misuse. Depending on the nature of the transactions, smart cards and
sophisticated digital signatures that use public key cryptography can frequently offer a reasonable
degree of reliability. The risk with these technologies is that any number that can be typed or any
card or token that can be inserted can also be disclosed to others or stolen. Parties seeking to avoid
a transaction might claim that their identifying number, card or token was given to others who then
acted as imposters. [27] Of even greater reliability is a properly implemented biometric−based digital
signature. When coupled with public key cryptography, biometric−based digital signatures become
an even more powerful tool that holds much promise. However, the widespread use of biometrics
would be expensive to implement, its commercial application is still relatively limited, and not every
transaction requires this very high degree of security. [28]
Moreover, electronic signature methods vary in their ability to ensure that an electronic document to
which they are bound has not been altered after signing. Some methods provide no assurance at
all, but systems using "public key, private key" digital signatures generally are designed to reveal
such alterations. Thus, the better approach is to vary the level of security, depending on the
significance of the underlying documents. For those records where the need for reliability is even
higher, agencies should consider using a combination of security methods. [29]
Indeed, a well−designed electronic system can make the indication of agreement more trustworthy
than paper documents that are ambiguous as to intent. The creative design of the agreement
formation stage of an electronic process offers agencies the possibility to develop an indication of
intent that is even more meaningful than one arising from traditional paper processes. For example,
when a multi−page paper document is signed only on the last page, the question is sometimes
raised whether all of the pages were included in the document the signer signed. An electronic
signature bound to the entire document eliminates any question as to the contents of the document
signed by the signer. With high value transactions, exceeding, rather than merely meeting, the
reliability standards of paper signatures, should be an agency's goal.
248
4. Federal and state statutes will affect agencies' use of electronic processes
a. The Government Paperwork Elimination Act
On October 21, 1998, Congress enacted the Government Paperwork Elimination Act, Pub. L. No.
105−277, §§1701−1710 (1998) (codified as 44 U.S.C.A. §3504 n. (West Supp. 1999)). [30] Among
other things, the GPEA provides for the development of procedures for agencies by October 21,
2003, to use and accept electronic signatures, [31] and for agencies to provide "for the option of the
electronic maintenance, submission, or disclosure of information, when practicable as a substitute
for paper" and "for the use and acceptance of electronic signatures, when practicable." GPEA
§1704. Moreover, "to the extent feasible and appropriate," agencies that expect receipt by electronic
means of 50,000 or more submittals are to have "multiple methods of electronic signatures"
available. GPEA §1703(b)(1)(E).
GPEA may leave issues unresolved. For example, GPEA may not necessarily make electronic
records valid and enforceable under all circumstances (any more than paper signatures are valid
under all circumstances). GPEA Section 1707 provides that certain electronic records or signatures
"shall not be denied legal effect, validity, or enforceability because such records are in electronic
form." (Section 101 of E−SIGN contains similar language about the validity of electronically
recorded commercial transactions.) While that wording bars courts from invalidating electronic
records and signatures merely because they are in electronic form, it does not require courts to
accept electronic records and signatures that are deficient in other respects merely because they
are in electronic form. For example, if there are reasons to doubt that it was actually the electronic
signature holder who affixed the signature in question, a court might not accept the electronic
signature, just as it might decline to accept a paper signature that could not be verified. Also, GPEA
may apply only to certain types of electronic signatures and to records that meet certain
requirements, such as the records submitted, used, or maintained in accord with the OMB Guidance
required by GPEA. [32]
b. State Statutes
Some states have enacted statutes designed to make certain electronic submissions as enforceable
as signed paper documents. [33] Because those statutes might only give effect to electronic
submissions that meet specified requirements, each statute must be examined for other provisions
affecting the proof of the transaction, such as who (the sender or receiver) has the burden of
proving whether the sender named in the transmission really sent it and whether its contents were
altered. [34] Some states have enacted broader statutes, including variants on the Uniform Electronic
Transactions Act (1999), which was promulgated by the National Conference of Commissioners on
Uniform State Laws. It is unclear to what extent the GPEA (discussed above in Section II.B.4.a)
might preempt certain of such state laws or parts of them, or the extent to which such state laws are
applicable to transactions to which the government is a party or acquires an interest (e.g.,
government−insured loans).
C. Reliability of Electronic Information
To be useful, agency information must be reliable and meaningful. While litigators are primarily
concerned about the persuasiveness of information in a courtroom, the usability of agency
information affects many aspects of agency work. Agency employees must be able to rely on the
information to function effectively within the agency as well as to discuss the results of agency work
with those outside the agency.
249
1. The Legal Significance of Context Surrounding the Collection or Creation of Electronic Information
Any information collection system should provide a means to define, limit and show the context of
the information supplied to the extent it is necessary for a particular transaction. For example, a
"form" to be filled out may require specified information to be supplied on particular lines or in
boxes, and such forms usually are accompanied by explanatory instructions. Completed paper
forms include a means of identifying not only the answers, but also the questions and instructions.
The meaning of the answers is evident from the document itself.
Electronic processes that use "forms" generally display a template of the form to the person filling it
out. The person enters the information requested by the form. If the system is designed to retain
and reproduce only the answers, and not the questions or instructions, disputes may arise over the
meaning of the information supplied. Knowing an answer without knowing the corresponding
question is of little value. Electronic submission systems generally should be designed to provide a
copy of the form (including all questions and instructions) in response to which information was
supplied to the agency, or bind the form to the answers provided. If an agency's forms change over
time, and the information on the form is important either to the underlying transaction or to an
agency process or program, then the electronic process should be designed to keep track of the
exact form used by each submitter of information.
2. The Perceived Reliability of Electronic Data
Even though many people routinely rely on electronic information, such as electronic mail, some
people are skeptical about the reliability of electronic data that are created by unfamiliar government
processes. Electronic information may not be perceived as reliable if the underlying processes that
create or maintain the data themselves are not viewed as reliable. For example, many people
believe that information in electronic storage is vulnerable to tampering, either by internal (i.e.,
within the agency) or external sources. [35] The internal vulnerability concerns can be addressed by
demonstrating that there are sufficient electronic procedures in place to prevent accidental or
unauthorized alteration of information and to provide an audit trail to trace all changes. The
concerns about external vulnerability may be met by showing that the computer system has
measures in place to prevent and detect intrusions from outside and to store important information
securely, off the network, where outsiders cannot obtain access to it.
3. Persuasiveness of Electronic Processes and Information Derived from Them
Because electronic processes in many respects are more complex than paper methods, explaining
them or their reliability may be more difficult. Whatever systems or methods are ultimately chosen
by the agency, the agency will need to provide reliable information regarding its systems (verified by
periodic audits) to a variety of audiences including judges and juries, agency employees, and
members of the general public with whom the agency has dealings. The agency should be able to
communicate this information in a straightforward and sensible manner and should recognize that
people are likely to have varying degrees of knowledge about such processes.
4. Admissibility of Information Derived from Electronic Processes
As with evidence in any form, electronic records must meet the legal requirements for "admissibility"
before the government can use them in court. Generally, the party seeking to introduce records
must show that the evidence is "authentic" (that is, provides proof that it is what it purports to be),
and that it is the "best evidence" (that is, that it is the original or an acceptable duplicate). In
addition, in order to be able to use electronic or any other agency records as evidence, the
government in most cases must establish that the records were generated and maintained by a
"trustworthy" process. If an electronic process does not reliably show who transmitted a piece of
250
information to the agency, when it was transmitted, and that it has not been altered either
intentionally or inadvertently, then, depending on the circumstances, the electronic record might not
even be admissible, which means that the record could not even be considered by the judge or jury
in deciding the merits of the government's claims or defenses. [36]
It is consequently of paramount importance that agencies using electronic processes ensure that
their processes store and reproduce records in a manner that will result in records that will be
admissible in court. In general, an agency's electronic processes must be able to produce reliably
the information that we discuss in Section III.C., below, and any other relevant information. To
determine what other information might be relevant for this purpose, agencies should consult the
Department of Justice or agency attorneys who litigate the particular agency's cases.
D. Legal Requirements Affecting Electronic Processes
The government has long−established systems for handling paper records in ways that generally
meet legal requirements regarding the use, storage, and disclosure of information. As agencies
convert to electronic processes, they must ensure that those processes also facilitate and comply
with such legal requirements. If disregarded, these restrictions could be a source of legal liability.
Legal requirements can affect the use of electronic processes in many contexts, some requiring that
the government be able to produce or disclose information, others prohibiting the government from
releasing specified information. Such requirements include:
• The Freedom of Information Act (FOIA), 5 U.S.C. §552 (Supp. IV 1998), requires release of
certain information in agency records to members of the public upon request. This statute
has been applied to computer records. See, e.g., Cleary, Gottlieb, Steen & Hamilton v.
Department of Health & Human Servs., 844 F. Supp. 770 (D.D.C. 1993). The FOIA statute
was recently amended to clarify the status of electronic records under public access law.
See Pub. L. No. 104−231, 110 Stat. 3048, §§ 1−12 (1996) (codified as amended in scattered
sections of 5 U.S.C. § 552). See also David MacDonald, Note, The Electronic Freedom of
Information Act Amendments: A Minor Upgrade to Public Access Law, 23 Rutgers Computer
& Tech. L.J. 357 (1997).
• Discovery in litigation. The federal government could be subject to discovery in any litigated
case (even if it is not a party). [37] Such discovery can reach electronic records as well as
paper records. Depending on the circumstances, the agency might be required to gather all
electronic records pertaining to a specified person, topic, transaction or event.
• The Federal Records Act (FRA) requires federal agencies to ensure adequate and proper
documentation of their policies, decisions, procedures, and essential transactions, by
maintaining "records" as defined under the FRA. See 44 U.S.C. §§3101 and 3301 (1994).
The National Archives and Records Administration has promulgated standards for the
creation, use, preservation, and disposition of electronic records, which also specifically
address the minimum requirements for electronic recordkeeping systems that maintain the
official file copy of text documents on electronic media, including e−mail systems. 36 C.F.R.
§§1234.22, 1234.24(b) (1999). The government's compliance with its FRA obligations as
they affect the preservation of e−mail and word processing documents has been the subject
of extensive litigation in the D.C. Circuit. See Public Citizen v. Carlin, 184 F.3d 900 (D.C. Cir.
1999); Armstrong v. Executive Office of the President, 1 F.3d 1274 (D.C. Cir. 1993). [38]
• The Privacy Act, 5 U.S.C. § 552a (Supp. IV 1998), imposes certain restrictions on agency
use of personal data. In enacting the Privacy Act, Congress was concerned predominantly
with the increasing use of computers and sophisticated information systems and the
potential abuse of such technology. Thomas v. United States Dept of Energy, 719 F.2d 342
(10th Cir. 1983). The Privacy Act also (1) requires agencies to provide notice about how
251
information in a system of records is stored, accessed and used; (2) requires agencies to
provide a means for subjects to challenge, correct or rebut information relating to those
records; and (3) provides specific standards for computer matching of electronic records
containing personal information.
• The Rehabilitation Act of 1973, 29 U.S.C. 701 et seq., prohibits federal agencies from
discriminating against otherwise qualified persons with disabilities. Sections 501 and 504 of
the Act prohibit disability−based discrimination against qualified individuals (employees and
members of the public) participating in federal programs. New Section 508 of the Act, 29
U.S.C.A. 794d (West Supp. 1999), as amended in 1998, requires that all electronic and
information technology systems and products used by any federal agency be accessible to
persons with disabilities, including both employees and members of the public. Agencies will
have to adhere to specific standards for accessibility of electronic products and systems.
Section 508 also authorizes individuals to file administrative complaints or to sue agencies
that have procured inaccessible electronic systems in violation of the law. [39]
• Other laws restricting agency disclosure of information, such as the Trade Secrets Act, 18
U.S.C. § 1905 (Supp. II 1996), prohibit federal officials from disclosing trade secrets or
certain other types of confidential information about persons or businesses, unless
authorized by law.
• Other laws and regulations require systems of records to be capable of verifying that
information in an agency's possession is used solely for authorized purposes and restrict
access to information for certain defined purposes and by only those agency officials who
are involved in those authorized purposes. These statutes and regulations will require
electronic processes to guard against unauthorized use of such information and track
access to that information. (For example, 26 U.S.C. § 6103 (Supp. III 1997) limits access to
a taxpayer's tax return information to only those Internal Revenue Service employees who
are directly involved in a matter involving that taxpayer; 8 U.S.C. § 1255a(c)(2)(B)(4), (5)
(1994), prohibits Immigration and Naturalization Service employees from using applications
for legalization for any immigration−related purpose other than the legalization program.)
Other statutes or regulations unique to a given agency might impose further requirements or
restrictions on the availability or disclosure of agency information. For example, an agency decision
to allow electronic submissions by the public raises many potential issues that should be
considered, such as the notice requirements of the Privacy Act, the requirements of the
Rehabilitation Act, and the requirements that the FOIA may impose on access to information
regarding submissions, including providing the electronic forms or templates used to capture the
submission.
[8]
Equally important is the need for any system — paper or electronic — to identify and authenticate
the government employees who acted on or approved the claim or transaction, and to record all
pertinent information about their actions.
[9]
Paper systems, of course, have their own retention and access control problems. Paper can be
destroyed by age or by fire, or the warehouse in which it is kept can be made inaccessible.
Moreover, paper records are expensive to store and can be difficult to locate. Employees must
remember to secure sensitive records under lock and key to prevent unauthorized access. Federal
agencies are generally familiar with these concerns. Electronic record systems properly
implemented may provide many advantages over their paper counterparts.
[10]
44 U.S.C. §§ 2101−2118, 2901−2910, 3101−3107, and 3301−3324
[11]
See Jeff Rothenberg, Ensuring the Longevity of Digital Documents, Scientific American, January
1995, at 42–47.
[12]
The term "writing" is defined by statute as any "reproduction of visual symbols." § 1 U.S.C. § 1
(1994).
[13]
Technology can blur the line between oral and written communications. For example, speech
252
recognition technology automatically (without a human intermediary) converts oral statements (e.g.,
by phone) into text. Whether such a transmission is oral or written is a perplexing issue, and might
depend on the particular situation and statute involved.
[14]
"Contracts" are simply legally binding agreements between two or more parties. Government
contracts can involve activities as diverse as government procurement, making and guaranteeing
loans to students or farmers, and making payments to providers under Medicare and other
government contracted−for benefit programs.
[15]
Although the federal government's transactions generally are governed by federal law, in some
instances, state laws supply the applicable rule.
[16]
The Uniform Commercial Code (UCC) also incorporates a Statute of Frauds in several of its
articles. Whether and to what extent a state Statute of Frauds or the UCC applies to federal
government contracts can be a complex question that depends upon the circumstances. See United
States v. Kimbell Foods, Inc., 440 U.S. 715, 728−29 (1979); United States v. Kelley, 890 F.2d 220
(10th Cir. 1989) (applying UCC § 9−504 to contract with SBA guaranty contract). The UCC requires
a "writing" — defined as any "intentional reduction to tangible form," UCC § 1−201(46) — that is
"signed." See UCC §§ 2−201, 8−319, 9−203(1)(a). A "signature" includes "any symbol executed or
adopted by a party with present intention to authenticate a writing." UCC § 1−201(39).
[17]
See generally R.J. Robertson, Jr., Electronic Commerce on the Internet and the Statute of
Frauds, 49 S.C. L. Rev. 787, 808 (1998) ("[T]here is a substantial likelihood that courts may balk at
finding that electronic messages satisfy the Statute of Frauds").
[18]
National Institute of Standards and Technology B Use of Electronic Data Interchange Technology
to Create Valid Obligations, 71 Comp. Gen. 109 (1991). Although opinions of the Comptroller
General are not binding upon the executive branch, see Bowsher v. Synar, 478 U.S. 714, 727−32
(1986), or on the federal courts, they may offer helpful or persuasive authority. That opinion would
not preclude a party in an action from asserting that an electronically formed contract was
unenforceable. Thus, there exists a risk that courts would decline to enforce electronic federal
contracts that have not been reduced to a traditional writing. That risk may be significantly reduced
by procedures that ensure that electronically recorded transactions fulfill the purposes for which the
law requires a "writing."
[19]
Tape recordings of oral agreements have failed to meet the requirements of the Statute of
Frauds. Sonders v. Roosevelt, 476 N.Y.S.2d 331, 331−32 (App. Div. 1984) (not a writing), aff'd
mem., 476 N.E.2d 996 (N.Y. 1985); Swink & Co. v. Carroll McEntee & McGinley, 584 S.W. 2d 393,
399 (Ark. 1979) (not "signed"). See also Parma Tile Mosaic & Marble Co. v. Estate of Short, 663
N.E.2d 633, 635 (N.Y. 1996) (holding that sender's name at the top of a faxed page was not a
"signature" for purposes of the Statute of Frauds where the sender's fax machine was programmed
to imprint the name automatically).
[20]
By contrast, courts sometimes refuse to find oral communications binding, and it will be important
for agencies to ensure that their electronic processes are not regarded as so haphazard or informal
that they are considered the equivalent of an oral communication. For example, courts have
construed 31 U.S.C. § 1501 (or its predecessor provision, 31 U.S.C. § 200(a)(1) (1976)) to hold oral
contracts unenforceable because they are not "in writing." So, too, could we expect the courts to
reject electronic documents that are more conversation−like than formal. In In re Kaspar, 125 F.3d
1358, 1359 (10th Cir. 1997), the court refused to hold that one party's oral statement was a written
one, even though the other party entered the information into an electronic document. Similarly, oral
contracts alleged to have been entered into by the federal government have been denied
enforcement on state law Statute of Frauds grounds. See, e.g., American Int'l Enters., Inc. v. FDIC,
3 F.3d 1263, 1269 (9th Cir. 1993) (applying California Statute of Frauds; citing other federal courts
applying Statutes of Frauds from Minnesota, Nevada, and Tennessee).
[21]
Experience teaches that signatures are important to connect the individual to the act, and in
some cases we have failed to prove our case where we have not had the defendant's signature. For
example, in United States v. Larm, 824 F.2d 780 (9th Cir. 1987), an allergist was acquitted of
Medicare fraud concerning claim forms he did not personally sign. In United States v. Brown, 763
253
F.2d 984 (8th Cir.), cert. denied, 474 U.S. 905 (1985), the conviction of a pharmacist was reversed
on some counts because the government could not link him, through a signature or initials, to claims
submitted to the government for brand−name drugs when generic drugs were dispensed.
[22]
Thus, for example, courts normally prohibit individuals from avoiding their obligations by
contending that they did not read what they signed, or that the contents were not explained, or that
they did not understand them. In re Cajun Elec. Power Co., 791 F.2d 353, 359 (5th Cir. 1986); see
Jones v. New York Life & Annuity Corp., 985 F.2d 503, 508 (10th Cir. 1993); Hill v. A.O. Smith
Corp., 801 F.2d 217, 221 (6th Cir. 1986); O'Neel v. National Ass'n of Sec. Dealers, Inc., 667 F.2d
804, 806 (9th Cir. 1982).
[23]
A "digital signature" is generated by using an algorithm that ensures the identity of the signatory
and the integrity of the data can be verified. Signature generation makes use of a value (commonly
referred to as the "private key") to generate a digital signature. Signature verification makes use of
another value (commonly referred to as the "public key") which corresponds to, but is not the same
as, the private key. Each user possesses a private and public key pair, and the private key is not
deducible from the public key. Public keys are permitted to be known widely, and assumed to be
known to the public in general. Private keys should not be shared. Anyone can verify the "digital
signature" of a user by employing that user's public key. However, signature generation can only be
performed by the possessor of the user's private key. See National Inst. of Standards & Tech.,
Federal Information Processing Standards Publication 186− 1, Digital Signature Standard, at 1
(1998).
[24]
By "biometric," we mean attributes arising from a person's physical characteristics or actions that
are unique to that person. These include codes derived from electronic analysis of fingerprints and
retinal scans, among others.
[25]
Exclusive reliance upon one biometric identification without providing any alternatives, however,
may run afoul of the Rehabilitation Act, 29 U.S.C. § 794d (West Supp. 1999), which may require
agencies to provide alternative means of identification for those who do not possess the requisite
physical characteristics (e.g., persons with prosthetic hands cannot provide fingerprints).
[26]
National Inst. of Standards & Tech., Federal Information Processing Standards Publication 190,
Guideline for the Use of Advanced Authentication Technology Alternatives, at 39−40 (1994).
[27]
On the other hand, paper signatures are susceptible to forgery. Forgeries of traditional signatures
can often be detected by handwriting analysis and forensic examination. Proving that someone else
used an electronic signature can be more difficult because the electronic signature has no attributes
that associate it with the individual unless a biometric method is used. However, it may be difficult
for an individual to explain how and why someone else was able to obtain access to an electronic
signature that had been assigned to her with instructions to safeguard it and keep it private.
[28]
As with other technologies, signatures in a biometric signature system that was not properly
implemented might be subject to challenge. If the method of recording and preserving the signature
is flawed, the signatures may not be considered reliable and may not be legally adequate to
establish binding obligations.
[29]
For a more detailed discussion of various types of electronic signatures, and the advantages and
disadvantages of each, see the OMB GPEA Guidance, "Implementation of the Government
Paperwork Elimination Act," May 2, 2000, Part II, Section 7, 65 FR at 25518.
[30]
Other federal bills have been introduced in Congress that may affect agencies' use of electronic
processes. Agencies should monitor the enactment of any such bill into law.
[31]
GPEA§ 1703(a) requires the Director of the Office of Management and Budget (OMB), in
consultation with others, to develop procedures for the use and acceptance of electronic signatures
by Executive agencies.
[32]
The GPEA Section 1707 safe harbor applies only to those records submitted, used, or
maintained in accord with the OMB procedures required by the GPEA. That raises the question
whether Section 1707 applies if an agency did not follow the OMB−mandated procedures in
implementing its electronic signatures. Also, the GPEA defines "electronic signature" as: "a method
of signing an electronic message that (A) identifies and authenticates a particular person as the
254
source of the electronic message; and (B) indicates such person's approval of the information
contained in the electronic message." GPEA § 1710(1). A court might decline to give effect to
electronic signatures that do not technically meet this definition (e.g., those that do not identify a
specific person or that do not indicate that person's approval).
[33]
For example, Illinois has enacted the Electronic Commerce Security Act, 5 Ill. Comp. Stat.
175/10−120(b) (West 1999), effective July 1, 1999, which provides that, subject to certain
exceptions, "[w]here a rule of law requires information to be 'written' or 'in writing' … an electronic
record satisfies that rule of law." Id. at 5−115(a). The statute does not apply to specified documents
such as wills, trusts, negotiable instruments, and instruments of title.
[34]
The Illinois statute (see preceding note), for example, provides that, if the parties use certain
types of security procedures, then it "shall be rebuttably presumed that the electronic record has not
been altered." Id. at 10−120(a).
[35]
Many may have the perception that electronic data are easily fabricated or forged. People
recognize that digital data can be copied perfectly, and then edited without difficulty. (Thanks to
popular computer photo−processing programs, there is even a growing awareness that digital
photographs can be created or modified with much greater ease than traditional photographs.)
Agency security procedures that prevent such modification should be robust and well documented.
[36]
For example, Rule 803(6) of the Federal Rules of Evidence (FRE) generally allows records of
regularly conducted activity (commonly called "business records") to be admitted into evidence. The
government frequently relies upon that rule to introduce agency records into evidence. But the rule
also provides that such record will not be admissible if "the source of information or the method or
circumstances of preparation indicate lack of trustworthiness." Similar provisions are contained in,
for example, FRE 803(8) (pertaining to admissibility of public records and reports) and 804(b)(3)
(statements against interest).
[37]
See Jay E. Grenig, Electronic Discovery: Making Your Opponent's Computer a Vital Part of Your
Legal Team, 21 Am. J. Trial Advoc. 293 (1997).
[38]
See also Electronic Records Work Group
(viewed Oct. 30, 2000) (collecting currently applicable guidance provided by the National Archives
and Records Administration governing federal agency submission of records schedules covering
the retention of electronic versions of e−mail and word processing documents).
[39]
For further information about agency obligations and liabilities under Section 508, visit the
Department of Justice's Section 508 home page. Section 508 Home Page (viewed Jan. 20, 2000)
. The General Services Administration also maintains
an inter−agency Web site that contains current information about Section 5008 at
(viewed Oct. 30, 2000) (collecting currently applicable guidance provided by the National Archives
and Records Administration governing federal agency submission of records schedules covering
the retention of electronic versions of e−mail and word processing documents).
39. For further information about agency obligations and liabilities under Section 508, visit the
Department of Justice's Section 508 home page. Section 508 Home Page (viewed Jan. 20, 2000)
. The General Services Administration also maintains
an inter−agency Web site that contains current information about Section 5008 at
Source Exif Data:
File Type : PDF File Type Extension : pdf MIME Type : application/pdf PDF Version : 1.4 Linearized : No Create Date : 2003:02:24 14:51:56+02:00 Creator : MSHTML 6.00.2800.1126 Modify Date : 2003:02:27 12:22:31-06:00 Page Count : 347 Page Layout : SinglePage Page Mode : UseOutlines Producer : htmldoc 1.8.23 Copyright 1997-2002 Easy Software Products, All Rights Reserved. Creation Date : 2003:02:24 14:51:56+02:00 Mod Date : 2003:02:27 12:22:31-06:00 Metadata Date : 2003:02:27 12:22:31-06:00 Title : Cyber ForensicsEXIF Metadata provided by EXIF.tools