computer forensics

The Fourth Amendment to the U.S. Constitution

The Fourth Amendment to the U.S. Constitution as well as state requirements govern the seizure and collection of any email messages that reside on a sender’s or recipient’s computer or other device. Does the person on whose computer the evidence resides have a reasonable expectation of privacy on that computer? If so, the Fourth Amendment requires a search warrant or one of the recognized exceptions to the search warrant requirements, such as consent from the device owner.

 

The Electronic Communications Privacy Act

If an Internet service provider (ISP) or any other communications network stores an email, retrieval of that evidence must be analyzed under the Electronic Communications Privacy Act (ECPA). The ECPA creates statutory restrictions on government access to such evidence from ISPs or other electronic communications service providers.

 

The ECPA requires different legal processes to obtain specific types of information:

Basic subscriber information—This information includes name, address, billing information, telephone number, etc. An investigator can obtain this type of information with a subpoena, court order, or search warrant.

Transactional information—This information includes websites visited, email addresses of others with whom the subscriber exchanged email, and buddy lists. An investigator can obtain this type of information with a court order or search warrant.

Content information—An investigator who has a search warrant can obtain content information from retrieved email messages and also acquire unretrieved stored emails.

Real-time access—To intercept traffic as it is sent or received, an investigator needs to obtain a wiretap order.

 

The CAN-SPAM Act

This was the first law meant to curtail unsolicited email, referred to as spam. However, the law has loopholes.

You do not need permission before sending email. This means that unsolicited email is not prohibited.

It applies only to commercial emails—emails that are trying to sell some product or service. Therefore, mass emailings for political, religious, or ideological purposes are not covered by the Act.

 

The only requirement of CAN-SPAM is that the sender must provide some mechanism whereby the receiver can opt out of future emails and that method cannot require the receiver to pay in order to opt out.

 

Restrictions on how the sender can acquire the recipient’s email address and how the sender can actually transmit the email:

A message cannot be sent through an open relay.

A message cannot be sent to a harvested email address.

A message cannot contain a false header.

 

These methods are often used by people who send spam email. Tracking down the original sender of the email is the first step in investigating spam. Unfortunately, the email is sometimes sent from offshore sites or relayed through an innocent third party’s servers. This makes prosecuting spam very difficult and enforcing a judgment almost impossible in most cases.

 

18 U.S.C. 2252B

This law is about perpetrators who attempt to hide the pornographic nature of their website, often to make it more accessible to minors.

This is a very serious concern, and one that sometimes arises in child predator cases.

Communication Assistance for Law Enforcement Act (CALEA)

CALEA is a U.S. wiretapping law. Its purpose is to allow law enforcement and intelligence agencies to lawfully conduct electronic surveillance by requiring that telecommunications carriers and manufacturers of telecommunications equipment modify and design their equipment, facilities, and services to ensure that they have built-in surveillance capabilities, allowing federal agencies to monitor all telephone, broadband Internet, and VoIP traffic in real time.

 

Foreign Intelligence Surveillance Act (FISA)

This U.S. law prescribes procedures for the physical and electronic surveillance and collection of “foreign intelligence information” between foreign powers and agents of foreign powers, which may include American citizens and permanent residents suspected of espionage or terrorism.

 

The law does not apply outside the United States but may be encountered by a forensic investigator in researching intelligence even if it does not specifically regard espionage or terrorism. The law is an important part of many agencies’ approaches to information gathering. It has been amended frequently so it is important to stay current on the latest revisions and court cases.

 

The USA PATRIOT Act

The USA PATRIOT Act of 2001 was passed into law as a response to the terrorist attacks of September 11, 2001. The Act:

Reduced restrictions on law enforcement agencies’ intelligence gathering within the United States

Expanded the Secretary of the Treasury’s authority to regulate financial transactions

Broadened the discretion of law enforcement and immigration authorities in detaining and/or deporting immigrants suspected of terrorism and related acts

Expanded the definition of terrorism to include domestic terrorism, thus enlarging the number of activities to which the PATRIOT Act’s extended law enforcement powers can be applied

 

In May of 2011, President Barack Obama signed a four-year extension of three key provisions in the USA PATRIOT Act: roving wiretaps, searches of business records, and conducting surveillance of individuals suspected of terrorist-related activities not linked to terrorist groups.

 

The PATRIOT Act gives law enforcement dramatically enhanced powers for information gathering and should be a part of the knowledge base for any forensic investigator.

7/2/2017

39

Summary

Email clients and servers

Email headers

Email tracing

Email server forensic examination

Laws related to email investigations

Page ‹#›

System Forensics, Investigation, and Response

© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.