SOF on Trial. The Technical and Legal Value of Battlefield Digital Forensics in Court

The book Information Security Systems has been published in late 2017 by Springer as part of the  Lecture Notes in Computer Science book series.

Together with Prof. Luigi Mancini and dr. Agostino Panico of the Information Technology Department of the Sapienza University (Rome) I wrote the chapter titled “SOF on Trial. The Technical and Legal Value of Battlefield Digital Forensics in Court“.

Here is the abstract: Continue reading “SOF on Trial. The Technical and Legal Value of Battlefield Digital Forensics in Court”

No More Data Retention in Italy?

Yesterday the Internet Traffic Mandatory Data Retention regulation expired without being re-enacted by the Parliament. This means that at the midnight of June, 30, all the Italian Telcos and ISPs just (or should have) deleted last year Internet usage information from their databases.

Maybe the Parliament and the Data Protection Authority just had a strike of consciousness and decided so, after having “forgotten” for years to stress test the national data retention legislation to check if it could still stands against the EU Court of justice 2014 decision that bashed the data-retention directive.

Or, maybe, the powers-that-be just forgot about the data-retention.

We’ll never know for sure, but fact is that current high profile criminal investigations are now deprived of an important information gathering tool.

Phoney and the forensics value of Iphone chat

Phoneys is a software that allows a user to change the content of an Iphone chat thus altering the meaning of the conversation.While this is just an entertainment software, it might have some disturbing impacts on a possible criminal investigation.

Indeed, SMS, chat transcripts and messages are routinely used as a source of evidence by lawyers and prosecutors on the basis that if something is on a phone it can be hardly be faked. Of course, this is not always true, of course evidences must be corroborated by independent checks, of course the legal community is not that dumb to give face value to a text on a phone screen. But…

Phoneys allows a malicious person to create a prima facie deceiving fact, by exploiting the fact that a message has actually been sent, thus leading the investigator into thinking that a conversation took place with the intended correspondent. In an emergency context, the necessity of taking immediate action might push him to under evaluate what has been shown as “evidence”, thus jeopardizing the final result.

Maybe this is a either a minor or non-existent issue. But judicial reality has proven to be more surprising then legal-thriller. So, next time you’re confronted with a message as an evidence, why not double check?

Just in case…

After Apple, Facebook Is the Next Target of Judicial Orders to Cooperate With Prosecutors

According to a statement published on the Brazilian Policia Federal’s website, a criminal court issued a “mandado de priso preventiva” (roughly, pre-emptive arrest order) against Facebook’s representative in Brazil, charged of not having cooperated in providing information about a Facebook page.

The Brazilian Court, unlike the San Bernardino’s one in the Apple case, chose to put its white gloves off and go straight for the jugular, leaving no doubt about the fact that cooperation with the public prosecutor is a mandatory duty for everybody, tech-companies included.

By comparing the Apple and the Facebook cases (and Google’s public position about the topic) a disturbing trend emerges: Internet companies (at least the so said “Over The Top” – OTT) “think different” about themselves. Why the OTT should be let alone, when an ISP is burdened (often for free, BTW), to provide a public prosecutor with wiretapping, data-retention, forensic support, and data-mining services? Like it or not, corporate criminal liability and obstruction to justice regulation still work for the OTT too, and the OTT must live with it.

This Facebook case further supports the opinion I’ve expressed about the true issue at stake: by one side, the lack of confidence is our social and legal system as a whole and thus the fact that you can’t actually trust a magistrate and a law enforcement agency; by the other side the “ubermensch” syndrome that affects (not only high-tech) companies and that leads them into thinking that they have the “right” (or the power) to part the right from wrong.