In June 2018, there was a blog article posted that discussed a "secret" tool
that was used to pull down user e-mail data from Office 365, known as the
"Activities" API. The blog author and other digital forensics contributors had a
debate around the ethics of forensic examiners and organizations having this
"secret" tool and not making it known to the forensic community and whether
it was appropriate to keep the tool secret. A direct impact, as illustrated from
LMG security blog, was around Business E-mail Compromise (BEC) and as to
whether you could prove there was a breach or not, rather than assuming a
breach based on lack of evidence and the organization having to deal with
consequences of the assumed breach.
Unfortunately, Microsoft has seemed to end access to the Activities API with
weeks of the issue being discussed publicly. Which may be a consequence in
it of itself.
Not just for the above scenario, but in general, do you feel it is ethical for
forensic examiners and organizations to share or not share newly identified
forensic artifacts and information (not custom developed tools) with the
forensic community at large? Does it depend on how the information was
identified? Should competitive advantage be considered?
Directions- The student will post one thread of at least 350 words. . All
assertions in the thread and replies must be supported by course materials,
good examples, thoughtful analysis, and at least 1 scholarly resource in the
thread, in addition to at least 1 scholarly resource in one of the replies. There
must also be an appropriate incorporation of Judeo-Christian
worldview/analysis and biblical principles. All sources must be cited in current
APA format.
Additional Resources-https://www.crowdstrike.com/blog/hiding-in-plain-s...
https://lmgsecurity.com/exposing-the-secret-
office... https://lmgsecurity.com/rip-office365-magic-unicor...
1
Sharing New Forensic Artifacts
Name
Institution
CSCI 511
Professor’s Name
Date of Delivery
2
Sharing New Forensic Artifacts
The forensic community at large ought to be informed of the new developments in the
fields which are of interest to them. Such kind of knowledge sharing helps professionals connect,
sharpen their skills, and perform exceptionally as they deliver their services. Companies such as
Microsoft are often accused of knowledge hoarding, and this practice has several destructive
consequences (Angel & Kelly, 2020). First, it is imperative to appreciate that computer
technology has a high rate of obsolesce. Therefore, the information that organizations and other
stakeholders hoard may never be of any value in the future. Second, important players are kept in
the dark about new innovations which could help them avert the ever increasing cyber security
threats (Teng & Wen, 2020).
Some of the firms which hoard information justify their practice with the argument that
actions of this nature are meant to guarantee confidentiality. The solution to the potential breach
of confidentiality is for the authorities to come up with updated laws and policies which keep
motivated offenders at bay while still allowing for cooperation between professionals (Zhang,
Choo, & Beebe, 2019). There are other organizations which indicate that the artifacts are still
being tested, and that they hope to share the relevant information at some point in the future.
Perpetuating this culture hurts all the legitimate stakeholders in an unprecedented manner.
Progress happens through cooperation and by building on the work of others. There ought to be
no opaqueness as pertains to research, development, and innovation (Angel & Kelly, 2020).
The ethical concerns which are often raised when the general public learn of the
application and use of secret artifacts may not arise if the legitimate stakeholders are informed in
a timely fashion (Davidoff, 2018). This is irrespective of whether those details are publicly
known or not. At least there would be a significant number of players who would come to the
3
defense of the accused organization, and they would let the public know that the artifacts were
developed with no malicious intent. This is the kind of mutual upbringing that the Bible teaches
in Romans 14:19 (King James Bible, 2022). Nonetheless, this desirable development cannot
come about unless the stakeholders communicate and are honest with each other.
4
References
Angel, M., & Kelly, J. S. (2020). Forensic document examination in the 21st century. Taylor &
Francis.
Davidoff, S. (2018, June 27). Exposing the secret office 365 forensics tool. LMG security.
https://www.lmgsecurity.com/exposing-the-secret-office-365-forensics-tool/.
King James Bible. (2022). King James Bible online. https://www.kingjamesbibleonline.org/
(Original work published 1769).
Teng, S. Y., & Wen, C. Y. (2020, September 28). A forensic examination of four popular cross-
platform file-sharing apps with Wi-Fi P2P. Journal of Forensic Sciences, 66(1), 315-322.
https://doi.org/10.1111/1556-4029.14574.
Zhang, X., Choo, K. K. R., & Beebe, N. L. (2019, August). How do I share my IoT forensic
experience with the broader community? An automated knowledge sharing IoT forensic
platform. IEEE Internet of Things Journal, 6(4), 6850-6861,
https://doi.org/10.1109/JIOT.2019.2912118.
