IT Policy | Audit | Investigate Cyber Crime

How to Conduct a Cyber Investigation

Collecting Evidence in Sequence

In the digital realm, an investigator must be careful lest her work run afoul of the myriad rules and laws that restrain her.  She must be mindful of ethics, and laws on privacy, contract, property and trespass (e.g., a web site owner might post terms that forbid her from entering the site).   

In e-discovery if her demands for records from another party are too onerous, the demand may be quashed.  (See for example Mirbeau of Geneva Lake, LLC v. City of Lake Geneva.)

So what is a prudent, responsible investigator to do?

Rational Behavior is Preferred

The investigator can often strengthen her probes and requests by ensuring that she systematically develops and collects evidence in a sequential order, and that each step she takes is rationally based on evidence she already possesses.  For instance, before an HR investigator peeks into an employee’s email records, the investigator is wise to document (1) that she has reason to suspect the employee’s records will contain something the investigator needs to see (such as harassing emails), and (2) the evidentiary basis for that suspicion.  

Good records by the investigator will show that she gathered preliminary evidence and deliberated logically before she barged into another person’s records or property.

Canadian Privacy Case Demonstrates the Principle

By way of example, see the decision by the Office of the Privacy Commissioner of Canada (PIPEDA Case Summary #2009-019) involving an investigation by an employer into whether an employee had violated his employment contract.   Somewhat like the laws of some European countries, privacy law in Canada (PIPEDA) generally restrains an employer from reading employee email stored on the employer’s computers.  

However, in this case the Privacy Commissioner observed that PIPEDA provides that "an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province."   The facts in this case showed that the employer conducted – and documented – a predicate investigation before it gazed into the employee’s emails.  The Commissioner found that before accessing the emails, the employer possessed evidence showing that this employee was violating his employment agreement and that information about this violation would likely appear in the employee’s email records.  Accordingly, the Commissioner concluded that the employer was justified when it decided to open the employee’s email records and the employer acted in compliance with PIPEDA.

Principle Applies to Many Kinds of Investigations

Just as an evidence-based style of investigation will help support an internal HR investigation, it will also help support e-discovery in litigation.  Normally when a requesting litigant demands computer records, a court is reluctant to force the responding litigant to search through them because searching is expensive and disruptive.  However, the court is more likely to require the search if the requester has a logical, evidence-based reason to believe that the cost of the search will be proportionate to the case at hand will likely reveal relevant information.  

This principle of e-discovery places a burden on the requesting litigant.  The litigant needs to possess and understand predicate evidence before it asks for more evidence.  

–Benjamin Wright

Attorney Wright trains cyber-investigators at the SANS Institute.

Read more on law of trespass in the data age.

 

 

Security and Privacy Policy Draftsmanship

Making Promises an Enterprise Can’t Keep?

How to draft corporate policies? That is a key topic I address in my SANS courses on data security law.

I argue that conventional drafting style for enterprise policies – security policies, privacy policies, data retention policies – is too ambitious.  Conventional style speaks in terms of requirements and seems to promise performance in the future.  For example, conventional drafting style might say, “The enterprise will maintain up-to-date anti-virus software.” or “The enterprise shall not give customer data to unauthorized people.”

As a business lawyer, I am skeptical of enterprises using such will, shall, must language.  The truth is that data security, data privacy and data management are very difficult for any enterprise, whether it be a corporation, a government agency, a nonprofit or anything else.  Technology changes constantly. Employees are imperfect.  New threats arise every day.  Social and legal expectations are evolving rapidly.

To sustain any data handling practice consistently across an extended period of time in a complex organization is an amazingly complicated challenge.  An enterprise is a dynamic collection of people, subject to changes in budget, assets, personnel, and so on.  (Have we recently witnessed the humbling of “powerful” institutions like the State of California or General Motors Corporation?)

When an enterprise adopts a policy that is too ambitious or unrealistic, I fear it increases its exposure to criticism and even liability.

Accordingly, in my course I teach students how to write softer, more general and more accurate language. An example is to say, “The enterprise strives to resist computer viruses.” or “The enterprise aspires to avoid giving customer data to unauthorized people.”

A published example of less ambitious, more accurate policy drafting is the LexisNexis Privacy Vision (notice the evocative word “vision”). 

The vision states: “LexisNexis strives to protect personally identifiable information . . .” “We aspire to protect consumer privacy through the design of our products, by credentialing . . .” “LexisNexis seeks to limit the distribution of personally identifiable information consistent with . . .” [emphasis added]

These sentences are worded as verifiable, present statements of fact, rather than predictions about a future that is unpredictable.

–Benjamin Wright, SANS Institute Legal Instructor

IT Security Policy Documentation

Detailed Written Procedures | Paperwork

Regulators should not to overemphasize documentation as a form of data security.  Paperwork per se does not protect sensitive data.

In practice, overly detailed documentation can hinder enterprise security, because threats, technology and enterprises themselves change very rapidly.  Keeping very detailed documentation up-to-date can be a distraction and a source of confusion.  Security should focus on substance.

Regulatory authorities can be tempted to emphasize documentation because it is easy to audit.

Fine for D.A. Davidson

The Financial Industry Regulatory Authority (FINRA) fined stock broker D.A. Davidson & Co. $375,000 after a hacker stole personal data on 192,000 Davidson customers.

This incident caused no identity theft among customers.

Does Imperfect Documentation Justify Fine?

A key reason for the fine, according to FINRA, is that Davidson’s security documentation was incomplete: “D.A. Davidson failed to . . . establish and maintain a system, including written supervisory procedures, reasonably designed to achieve compliance with Rule 30 of Regulation S-P.” FINRA Letter of Acceptance, Waiver and Consent No. 20080152998.

According to Rule 30, “[e]very broker, dealer . . . must adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information. These written policies and procedures must be reasonably designed to: (1) insure the security and confidentiality of customer records and information . . .”

Let’s look more carefully at what FINRA said about Davidson’s lack of documentation.  It said: “The Firm also did not have finalized and implemented written procedures in place for its information security program that, among other things, should have been designed to protect confidential customer information.”

Was There a Substantive Shortcoming?

So what were the particular shortcomings in the documentation? FINRA said:

1. “The Firm did not have any written procedures in place for the review of system web server logs, nor an intrusion detection system.”

2. “Even if it had detected the intrusion, the Firm did not have written procedures setting forth an information security program designed to respond to intrusions.”

This lack of documentation needs to be seen in context.  Davidson did have a security program (including a firewall and a practice of regularly reviewing perimeter security logs) under the care of IT professionals. It had recently engaged with security auditors and consultants and had implemented the “majority” of their recommendations.

FINRA did not say that Davidson had no security documentation, or that Davidson’s IT professionals were incompetent.  From what FINRA said, it appears Davidson did have documentation, maybe quite a bit. Some of it was not finalized; in IT security today, nothing is ever final because technology and threats change constantly.

Further, FINRA did not find that Davidson responded poorly to the incident once it was discovered.  In fact, FINRA cited a series of intelligent steps that Davidson took when it learned of the break-in (such as taking down the firm’s web site, contacting law enforcement and hiring an outside consultant for remediation).

Should Regulators Expect InfoSec Perfection?

Security is very difficult.  FINRA does not talk about that in this Davidson ruling.  Regulators are imprudent to expect perfection. Security perfection does not exist.

FINRA did not analyze how difficult it would have been for Davidson to become invulnerable to attack.

It is easy for a regulator to look back with the benefit of hindsight and say, “Oh, you forgot to review web logs.”  What is much harder is for an enterprise like Davidson – on a prospective basis – to find, evaluate and close off all possible vulnerabilities, while at the same time providing good service to customers at a good price.

Why a Fine for Failing to State Common Sense?

One of the two documentation shortcomings FINRA cited was intrusion response procedure.  What magic did FINRA think was missing in the documentation to inform IT professionals how to respond to an intrusion? Intrusions come in a multitude of flavors, and the flavors change over time.  The most competent intrusion response procedure to document would be general: “In the event of a suspected intrusion, strive to investigate it, keep records of the investigation and take appropriate steps to mitigate it, based on the circumstances.” So what is the problem about not explicitly writing this sentence in documentation?  The sentence is just common sense to IT professionals.

FINRA’s report does not tell whether Davidson had other evidence that its professionals knew how to respond to an intrusion, such as training, experience or discussions recorded, for example, in email.

FINRA’s emphasis on formal documentation worries me because it gives the impression that documentation in and of itself is really important to regulators. Such an impression can cause enterprises to overdo the paperwork, creating long, rigid, expensive documents to show to auditors and regulators.

What's More Important, Paperwork or Substance?

Leaders at the SANS Institute have long criticized FISMA (law requiring information security in Federal government agencies) as a misguided and wasteful call for paperwork rather than substantive security.  See comments by Alan Paller and Ed Skoudis, SANS NewsBites, April 23, 2010, Vol. 12, Num. 32 .

–Benjamin Wright, Legal Issues Instructor, SANS Institute

Social Media Investigation

Deception by Spouse or Employer

A responsible investigator should think carefully before misrepresenting his identity on a social network in order to gather information. In, for example, a divorce or insurance case, a private investigator might be tempted to falsely identify himself as a friend or acquaintance in order to trick the target of investigation to “friend” the investigator and unwittingly reveal the secrets available only to the target's circle of approved friends.

Historically courts have been suspicious of private investigators who use deception to persuade targets to lower their guard.  Courts have construed the deception as a violation of privacy.

Just as an investigator should normally shun misrepresentation, the principal (such as a spouse in a divorce case) who hires the investigator should monitor the investigator's work to prevent misrepresentation, lest the principal also be held liable for the privacy violation.

See Hawkes v. Commercial Union Insurance Company, (Maine Supreme Judicial Court, January 16, 2001), which held an insurance company could be liable for invasion of privacy by an independent private investigator working for the company. The plaintiff, Hawkes (the person suing the company), had submitted a worker's compensation claim for on-the-job injury, which the company was investigating. The company was suspicious whether Hawkes possessed a legitimate claim for a work-related injury. So it engaged a private investigator to surveil Hawkes and gather evidence. The investigator used false pretenses to gain entrance into the Hawkes home. The court held that the investigator and the company had invaded Hawke's privacy. The court required the company to pay for the invasion.

In the physical world an undercover police officer can generally claim to be someone he is not.  Do the same rules apply for an undercover officer in cyberspace?  Generally speaking, a police agency sending undercover officers online is wise to subject the online activity to written procedures, judicial supervision and management supervision.

Update: Some surmise that FBI is scanning social networking sites like Facebook for combinations of words that suggest criminal activity. One report suggests this monitoring led to the arrest of a man in the UK who was threatening to shoot people at a school. 

–Benjamin Wright

Mr. Wright teaches investigation law at the SANS Institute.

Information Security Legal Certification | GLEG

GIAC | Global Information Assurance Certification

The SANS Institute's law & investigations course series LEGAL-523 is associated with a GIAC cert, called GIAC Legal (GLEG).     

Over 600 proud professionals hold or have held this unique certification as of September 2014.

Numerous LinkedIn members, like information assurance professional Joel Baese, list GLEG certification on their profiles.

 Credentials for Investigators

Increasingly, as more evidence of human activity is captured digitally, infosec professionals are expected to conduct investigations.  "Investigator" is becoming a key part of their job description.  The LEGAL-523 course series (supported by the GLEG) teaches these professionals the skill set to execute competent, defensible investigations.   

You don’t know how important something is until you are about to lose it.  Late 2009 GIAC decided to discontinue the GLEG for economic reasons.  But that caused an uproar when I taught the LEGAL 523 course in December.  Fortunately GIAC reconsidered and changed its mind.  When we delivered LEGAL 523 in March 2010, a record-setting number of students (~15) signed up to take the GLEG, which was a pleasant surprise to GIAC!

The law of information security and cyberforensic investigations is challenging . . . and developing rapidly.  Many employers want their professionals to possess training on the topic, and the GLEG confirms that training.  It shows that a student did more than register for a class; it shows the student studied and mastered the material.   Also, some LEG523 students say they want the certification because it enhances their credibility as expert (forensic or otherwise) witnesses in a courtroom or in an investigation. 

GIAC as World Leader

I’d be happy to hear comments and answer questions about the GLEG certification or GIAC in general.  GIAC offers certification in many fields of IT security, e.g., Windows security GCWN.

News:  SANS Masters Degrees in cybersecurity are now accredited.

By: Benjamin Wright, Senior SANS Instructor who developed and teaches LEGAL 523: The Law of Data Security and Investigations.  See comments about the SANS Legal 523 course.

Postscript:  A topic of growing impact in the Legal 523 course is ethics for IT security and forensics professionals.

Update 2014 on SANS Institute's Legal 523 course.