Advertisement
Advertisement

It's all in the files

Danyll Wills

What could a corrupt energy company, a 'milkshake murderer' and a paedophile possibly have in common?

Each underestimated the power of digital evidence and the ability of computer forensics experts to follow its trail.

Digital or computer forensics - the application of science and engineering to the recovery of evidence - has taken an increasingly important role in solving crime. Experts are able to extract deleted, encrypted or damaged file information from electronic devices, including personal computers and mobile phones.

United States-based energy company Enron, which employed about 22,000 people and claimed revenues of almost US$101 billion in 2000, filed for bankruptcy in late 2001, when it was revealed the firm had systematically committed accounting fraud. It was the largest corporate failure in the US at the time.

When prosecutors began to investigate the digital records of Enron, its accounting firm, Arthur Andersen, and key executives, they found the damning evidence they needed. The FBI's five-year investigation yielded more than 31 terabytes of data, gathered from more than 130 computers, thousands of e-mails and 10 million pages of documents. A terabyte is equivalent to 1,000 gigabytes; at an average of 5,000 characters per page, 1TB of disk space can hold about 250 million pages of text (a stack of paper 10 miles high if printed on both sides).

Andrew Rosen, the president of computer forensics software and services firm ASR Data, which undertook the Enron data recovery, says cases involving such vast amounts of data are increasing, especially since personal computers with a 1TB hard-disk are no longer rare.

'It's becoming more commonplace for law enforcement to be overwhelmed by investigations involving terabytes of data,' says Rosen.

Most of us have an electronic record out there. People routinely send e-mail and text messages not thinking they might later be read by a third party. E-mails, particularly those on a company server, are often kept for seven years.

Paul Jackson, chief inspector at the forensics and training section of the Hong Kong police's technology crime division, says the unit was set up in 2001 to handle increasingly sophisticated, information technology-related cases.

The police procedures shown in the popular US television series CSI: Crime Scene Investigation might seem realistic to viewers but experts say the show simplifies the process and its results. For example, the characters conduct raids, interrogate suspects and solve cases - actions that in reality are undertaken by uniformed officers and detectives.

'The role of the computer forensics examiner is not to make an argument but rather to preserve, collect and analyse what exists on a computer system,' says Richard Kershaw, a principal for global expert services company LECG, which provides independent expert testimony and strategic advice to large corporations and government agencies.

Computer forensics evidence played a role in the Hong Kong case of American expatriate Nancy Kissel, who was dubbed the 'milkshake murderer' after she bludgeoned her investment banker husband to death after serving him a strawberry milkshake laced with sedatives. Kissel was convicted of murder and jailed for life.

Her husband, who had suspected Kissel of infidelity, secretly installed spyware on her notebook computer. The software sent him regular updates about her online activities.

During the trial, in 2005, an expert from the police's technology crime division said Kissel's laptop had been used to browse the force's website on missing and wanted persons four days after she murdered her husband, in November 2003. The findings were supported by a spyware activity report sent to the e-mail account of her deceased husband.

Kissel attempted to portray her husband as work-crazed, abusive and controlling. So her defence team, helped by computer experts, produced evidence that suggested her husband had a history of searching websites for gay pornography and sex services, using a laptop that was allegedly also used by their children.

But that laptop proved damning for the defendant instead; the police showed it had been used to research Rohypnol, known as a date-rape drug. The trial revealed that the drug had been prescribed to Kissel and was found in her dead husband's stomach.

In the case of Chow Yuen-fai, there was no refuting his guilty plea in August to 10 charges - including indecent assault, homosexual buggery with a person under 21 years of age and the making of child pornography - because he kept incriminating electronic records.

Last year, police found nearly 10,000 pictures and 300 videos of nude children and depictions of graphic sex acts between children and adults on a computer at Chow's Sham Shui Po flat. He was sentenced to 11 years in jail.

Experts say the uncertain global economic situation could result in an increase in cyber crime.

'In these times, people may find themselves in a position where stealing from their employer to make ends meet is increasingly tempting. They are also more vulnerable to approaches from organised gangs to provide information which will allow those people easier access to their company's systems and information,' says Nigel Jones, adjunct professor at the University College Dublin Centre for Cybercrime Investigation. Jones says that any company that is considering putting the brakes on information-management and security spending would be making a mistake.

'This is the exact time when such expenditure should at the very least be maintained,' he says.

And the police are prepared for any upturn in cyber crime, according to Jackson. 'The force is a large one - about 27,000 - and there are many officers with a computer science or engineering background.'

Kershaw adds that Hong Kong has the advantage of being a mature jurisdiction in terms of digital forensics analysis because 'it is generally accepted that the data presented [in evidence] can be relied upon'.

So if you are thinking of doing something illegal, you may want to think long and hard about the digital traces you'll leave; they may be a lot more obvious than you think.

The people interviewed for this story will speak at the High Technology Crime Investigation Association Asia-Pacific Conference 2008, from December 10 to 12 in Hong Kong. For more details visit http://2008.htcia.org.hk.

Post