Computer Evidence

Welcome to our blog

2009-08-25T22:30:00.006+08:00

Hi everyone.

Welcome to our blog. We, the authors, are the 2nd year law students from the Faculty of Law, National University of Malaysia. This blog, which is basically on Computer Evidence is created as a requirement for the Cyber Law course under the observation of our respected lecturer, Dr. Nazura Abdul Manap. Kindly visit our blog for updated posts and do leave your comments or suggestions.

Thank you.

Content

2009-08-25T22:22:00.024+08:00

COMPUTER EVIDENCE

1.0 Introduction
1.1 What is Cyber Law

1.1.1 Cyber Law in Malaysia
1.2 Cyber Crime in Brief

2.0 What is Computer Evidence
2.1 Definition of Computer Evidence
2.2 The Importance of Computer Evidence (the problems and solutions)

3.0 Computer Evidence: Processing Process

4.0 Comparison with Physical Evidence
4.1 Strength and weaknesses in Computer Evidence

5.0 Computer Evidence in Malaysia
5.1 Introduction
5.2 Classification of Computer Evidence
5.3 Weight of evidence
5.4 Primary or Secondary Evidence
5.5 Burden of proof
5.6 Malaysian Decided Cases

6.0 Articles and Journals (views and comments)

7.0 Conclusion

8.0 Referrences

9.0 Appendix 1

9.1 Glossary

1.1 What is Cyber Law

2009-08-25T22:00:00.009+08:00

1.0 INTRODUCTION

1.1 WHAT IS CYBER LAW

Here, the definitions of cyber law in general from various sources that I managed to get.

According to Cyber Law or Internet Law Terminology- Bambi Faivre Walters, PC, cyber law means, the law that governs World Wide Web and inter-networked information technology. Cyber law covers many areas of law and regulation including intellectual property, freedom of expression such as free speech, privacy and jurisdiction as examples choice of law, conflicts of law and others.

Business Dictionary.com, defines cyber law as, rapidly evolving area of civil and criminal law as applicable to the use of computers, and activities performed and transactions conducted over internet and other networks.

The definition given by Webter’s New World Law Dictionary is, the area of law dealing with the use of computers and the Internet and the exchange of communications and information thereon, including related issues concerning such communications and information as the protection of intellectual property rights, freedom of speech, and public access to information.

There is no definite or exact definition for cyber law, but from several definitions given, we can conclude that, cyber law is the set regulation that deal with the matters related to the application in the computer, so called internet.

POSTED BY; NURUL HIDAYAT BINTI AB RAHMAN

1.1.1 Cyber Law in Malaysia

2009-08-25T21:00:00.008+08:00

1. 1. 1 CYBER LAW IN MALAYSIA

The Malaysian Government has enacted several set of regulations to deal with the problems and crimes which related to networked information devices and also technologies. It is called as cyber laws. The government had taken an early step which is in 1997, by providing an inclusive framework of societal and commerce-enabling laws which cover aspects regarding security of information and network reliability. Various topics had been covered by the regulations passed, as examples, intellectual property, freedom of expression, jurisdiction, copyright, privacy and many mores. There are six cyber laws that have been passed, which are:-

1) Telemedicine Act 1997

It is an act to prewide for the regulation and control of the practices or the application of telemedicine in Malaysia and anything related to it.

2) Digital Signature Act 1997

This act was enforced in 1^st October 1998. It is an act legalizes the legal recognition and authentication of the creator of an electronic document. The target of this act is actually to promote the processing of transactions such as commercial transactions through digital signatures.

3) The Copyright (Ammendment) Act 1997

Copyright protection in our country is governed by the Copyright Act 1987. It provides a very sufficient protection for copyrightable works. The copyrightable works includes computer software. But then, as the world of Information technology developed, it has challenged the traditional concept of copyright protection. Because of that, the Amendment Act comes into force, which amended the Copyright Act 1987. This Act seeks to update the law on copyright. As a sum-up this particular act provides the copyright protection on-line.

4) Computer Crimes Act 1997

This act is enacted in order to impose penalties on fraudulent, dishonest acts and misuse of computer which can be considered as crime, either it is committed outside of the country. It deals with unauthorized access, unauthorized access to commit further offenses and unauthorized modification. There is also a provision to make possible investigations for the enforcement of the Act. The Act elaborates about the crimes and also provides the punishments. Usually the use of this act will be also referred to the traditional act, Penal Code.

5) Communications and Multimedia Act 1998

This is most important legislation which enforced on the 1st April 1999. The legislation concerned about the policy, regulatory framework for convergence of the telecommunications, broadcasting and computer industries.

6) Malaysian Communications and Multimedia Commission Act 1998

It is an Act to provide for the establishment of the Malaysian Communications and Multimedia Commission, with powers to supervise and regulate the communications and multimedia activities in Malaysia and to enforce the communications and multimedia laws of Malaysia, and for related matters. (accordance to the act itself)

POSTED BY; NURUL HIDAYAT BINTI AB RAHMAN

1.2 Cyber Crime in Brief

2009-08-25T20:11:00.008+08:00

1.2 Cyber Crime in brief

It can be denied that, computer and information technology (IT) are very important nowadays. It can be said that, the use of computer or any similar technology can helped human in solving many problems each day. For examples, by using computer and IT, work can be done faster, information all around the world are at the fingertips, time can be saved and work done is organized and systematically. But, as usual, when there is pro, there must be a contra. The misuse of the technology can lead to many crimes which committed in different way. It is known as cyber crime.

Cyber crime is the criminal activity which had been done through the computer. Many computer experts define cyber crime differently. Some, referred cyber crime as, any crimes committed through computer. There are some, concluded that it is a crime done at cyber space not in a real world. Accordance to the blog’s author opinion, the definition of cyber crime relies on the situation, objective or the aim of the persons study.

The examples of the crimes can be committed are theft, cheating, forgery, trespassing and others. Specific terms had been used to address such crimes, such as; hacking, cracking, salami slicing, stamming, wardriving, phising scams, cyber stalking, denial of service attack, spam and many mores.

As to deal with these crimes, most of the country in the world had enacted law related to cyber crimes. Eventhough, there are special provisions that had been provided, problems to convict criminals, occurred subject to the matter of evidence. This is because, the crimes in cyber space is dissimilar with crimes in real world.

Here, is a simple illustration given by the blog’s author in order to complete your understanding about the disparity of cyber crimes and real crimes.

A, a theft had stole money from a shop, he maybe left his fingerprints, footsteps or any other physical evidences such as tools used in the crime.

B, a theft had transfer money from people’s accounts’ to his own account. He, for sure did not left any fingerprints, footsteps, tools or any other things. Besides, he can easily modify the application in the cyber space to cover his wrongful act. For example, delete the transaction that had been done.

So, in this blog, all four authors had been assigned to discuss, explained and elaborate further on computer evidence; the problems, solutions, strength, weakness, procedures and many mores.

POSTED BY; NURUL HIDAYAT BINTI AB RAHMAN

2.1 Definition of Computer Evidence

2009-08-25T19:00:00.008+08:00

2.0 WHAT IS COMPUTER EVIDENCE

2.1 DEFINITION OF COMPUTER EVIDENCE

There are no, exact or any specific definition of computer evidence. Besides that, it should be explained that, the word ‘computer evidence’ also referred to the term such as ‘computer forensic’ which also called ‘cyber forensic’. Some used the term of ‘digital forensic’. According to Search.com computer forensic means the application of computer, and analysis techniques to gather evidence suitable for presentation in a court of law. It aims, is to provide a framework of investigation while uphold a documented chain of evidence to discover out accurately and exactly what happened on a computer and the person liable for it.

Search Security.com had described computer evidence as, rather unique and exclusive technique when compared to other forms of more traditional documentary evidence. Different from paper documentation, computer evidence is extremely fragile and it takes place in the form of an identical copy of an exact document that is stored in a computer file. In addition, the legal "best evidence" rules differ for the processing of computer evidence. However, there is the potential for unauthorized copies to be made of important computer files without leaving behind a trace of that copy.Other than that, computer forensic also said as a branch of forensic science, pertaining to legal evidence found in computers and any other storage mediums.

Michael J L Turner, a computer expert, defined, computer evidence is data from computer systems that is used as evidence in legal proceedings.

Dorothy A. Lunn’s, definition of computer forensics is, the employment of a set of predefined procedures to thoroughly examine a computer system using software and tools to extract and preserve evidence in criminal activity.

Judd Robbins, a computer forensics investigator, defines computer forensics as, simply the application of computer investigation and analysis technique in the interest of determining the potential legal evidence.

James Borck, in his article had described computer forensics as the equivalent of surveying a crime scene or performing an autopsy on a victim.

By all the definitions given, it is clear that the elements of computer evidence, so called computer forensics and many other terms, are; the application of computer investigation, technology tools, procedures and also analysis techniques.

POSTED BY; NURUL HIDAYAT BINTI AB RAHMAN

2.2 The Importance of Computer Evidence (Problems and Solutions)

2009-08-25T18:00:00.008+08:00

2.1 THE IMPORTANCE OF COMPUTER EVIDENCE (PROBLEMS AND SOLUTIONS)

The importance of computer evidence is, to comply with nowadays crime method which is by using technologies devices. Such methods of committed crime is extremely hard to prove as, the evidence which usually includes many forms such as fingerprints, DNA test, footsteps or any gadgets or tools to. But, here in cyber space, the evidence maybe complete files on computer hard drives, diskette, CD-ROM, online transactions and many others abstract evidences.

In computer evidence there are two categories of data collected. The first one is known as persistent data. It is stored on local disk drives or on other media. It is protected when the computer is powered off or turned off. While, volatile data is stored in random access memory and lost if the computer is turned off or loses power. Volatile data is located in caches, random access memory (RAM) and also registers. Computer expert should recognize the best and safe ways to capture volatile data. It is important for security staff and network administrators to have knowledge regarding network and computer administration task effects on computer evidence process and the capability to recover data lost in a security incident.

In this globalization era it is essential for network administrator and security staff of networked organizations to practice computer evidence and should have lots of knowledge and information of laws related because the rate of cyber crimes is increasing greatly.

It is very important for mangers and personnel who want to know how computer evidence can become a strategic tool of their organization security. Personnel, security staff and network administrator should be familiar with all the issues related to computer evidences. Computer experts may exercise advanced tools, gadgets and techniques to locate or recover deleted, damaged or corrupt data and any other evidence against attacks and intrusions.

These kinds of evidences are collected to pursue cases in criminal and civil courts against those criminals who committed cyber crimes.

The survivability of network infrastructure of any organization depends on the function and application of computer evidence. In the present situations computer evidence is the basic element of computer and network security. It is such a big benefit for the company if it has workers that knew all about the technical and legal aspects of computer evidence. If the network of the company being attacked and the intruder are caught, computer evidence’s knowledge will definitely assist the company to provide evidence and for sure to prosecute and impose liability on the criminals.

But, it is extremely significant and vital to know the risks if there malpractices or misconducts of computer evidence. The fist one is, the evidence might or can be destroyed easily. So, if the data is not appropriately protected then many liabilities can be assigned to the organization. Nowadays, new rules had been regulated which can bring organizations in criminal or civil courts if the organizations fail to protect customers data’s. Organization funds can also be saved by applying computer evidence. Many reported that most large companies and organizations spent lots of budgets for network and computer security.

As we all know, organizations are increasing daily, so that the hackers are also increase. Because of that, the organizations will have developed their own security systems. Here are some examples; intrusions detection systems (IDS), proxies and firewalls which report on the security status of network of an organization. So it can be concluded, that technically the foremost goal of computer evidence are to identify, collect, protect and examine data in such a way that protects the reliability of the collected evidence to use it efficiently and effectively in a case.

Investigation of computer evidence has some typical criteria. The first one is, computer experts who examine computers must know the sort of evidence they are looking for. Besides that, cyber crimes are wide in range such as child pornography, theft of money or personal data and destruction of data or computer via viruses and hacking. Secondly, computer must use proper gadgets. The computer experts should have knowledge of software, latest techniques and methods to recover the deleted, encrypted or damaged files and the most crucial part is to prevent further damage in the process of recovery.

Here, are some cases which can be referred in order to expand your idea about computer evidence.

Case of Blanton 1995

When Colonel Oliver North was under investigation during the Iran Contra affair in 1986, he was careful to shred documents and delete incriminating e-mails from his computer. However, unbeknown to him, electronic messages sent using the IBM Pro Office System (PROFS) were being regularly backed up and were later retrieved from backup tapes

Case of Cowen 2003

A man, Michael Mc Kevitt was charged with directing terrorist activities. He also has being accused of involvement in a bombing incident in Northern Ireland. The defendant allegedly contacted an FBI agent on behalf of the Real IRA to obtain laptops for bomb detonation, encryption software, and personal digital assistants. Mc Kevitt apparently saw cyber terrorism, which is the use of networks to cause panic and loss of life-as the future bombing and was taking steps to enlarge and expand his terrorist organization’s capabilities in this area. The evidence in this particular case is laptops, e-mail messages, and mobile telephone records.

Case of Maryland 1996

A woman, Sharon Lopatka had told her husband that she was going to visit her friends. But, she left a chilling note that caused her husband to report to police that she was missing. Throughout the investigation, the police had found hundreds of e-mail messages between his wife and a man named Robert Glass. It is about their torture and death fantasies. By using the e-mail, it led them to Glass’s trailer in North Carolina and found the wife’s shallow grave nearby. It is stated that her hands and feet were being tied as she had being strangled. In this case, Glass pleaded guilty that he killed Lopatka by accident during their sexual intercourse.

Case of US v Grant 2000

In an investigation into tarnished online Wonderland Club, the defendant argued that all evidence found in his home should be suppressed as the investigators had failed to prove that he was guilty; associated with the illegal online activities. However, the prosecution at last had succeeded to present sufficient corroborating evidence to prove their case.

POSTED BY; NURUL HIDAYAT BINTI AB RAHMAN

3.0 Computer Evidence: Processing Process

2009-08-24T18:09:00.004+08:00

According to the International Organization on Computer Evidence, there are some principles that must be applied in order to recover digital evidence. The must apply principles are as follow:

All digital evidence will apply the same general rules as evidence.
The evidence must not be changed upon the process to seize the digital evidence. Precautions must be taken.
Only a trained person can access to the original evidence when needed.
Any activity to the evidence such as seizure, storage, access or travel must be documented, preserved and made available for review.
The responsibility of the evidence is upon the person who possessed it at the time.

There is no such thing as a specific way to process the computer evidence. It basically relies on the circumstances of the cases itself. Processing them need a lot of skills and details. As in this blog, I will give you only a general guideline on how to process computer evidence.

Taking precautions.

Some precaution must be taken to minimize the risk of changing any evidence and also contamination to the evidence. This is as to preserve the sensitive evidence such as fingerprints and DNA. Precautions taken are not only for the benefits of the evidence but to the person taking the evidence themselves. It is to avoid any dangerous substance which is why the person must wear appropriate crime suits such as gloves and face masks.

Document the physical evidence.

Firstly is to document the physical evidence. Physical evidence here refers to the computer itself. To document the physical evidence, you can take the pictures of the computer such as the picture of the screen, the arrangements of the scene (which includes the computer) and others. This is important as to ensure the originality of the evidence. Labeling all evidence is also required as a procedure to avoid mistakes or carelessness in processing the evidence. The labels may include the name of the person responsible in collecting the evidence and his organization, descriptions of the material, the location of the material seized and the date and time.

eg:

Name:

Description:

Location:

Date:

Time:

Signature:

Shut down the computer.

After documenting the physical evidence, you need to shut down the computer properly to avoid any changes to the evidence of the case. The process of shutting down is by commanding the operating system and then to pull out the plug. It is important for you to try to detect if there is any process or operation that can destruct or eliminate important data in the computer system. The simplest example is the screensaver which will automatically produces time delayed password. This will basically interrupt the process of shutting down the computer.

Document the system’s hardware configuration.

Processing the computer will require the computer to be removed to a secured place for which the computer needs to be disassembled. So, before disassembling the computer, pictures of the computer from every angle must be taken in order to ensure the right configuration of the computer. This is important as to the process of reassembling the computer after relocating it to the processing location. Different configuration may give effect to the operation of the system.

Relocating the computer to a secured location.

It is very important to transport or transfer the computer to another location which is more secured. This is to prevent any conduct that can destroy, damage or change the data needed. Irresponsible or curious individuals can have the possibility of doing those conducts which is why it is important to secure the computer. The simplest way to secure it is by not leaving the computer unattended and if you do, make sure that the computer is in a secured location.

Backups the hard disks and floppy disks.

After relocating the computer, you have to backups the hard disks and floppy disks before you operated the computer. The original evidence is not for touched unless there is compelling circumstances. The processing process must be done in the backup data, not in the original system.

The system data and time is to be documented.

Next, is to document the system data and time. This is to provide for a better standpoint in presenting the evidence and the documentation must be of accurate and precise. An hour different can create different consequences to the evidence.

Using key search words.

It is hard for a computer specialist to manually view each and every file on the hard disk. There is software which can help you make a list of key search words to help make your work more efficient.

. The processing of evidence.

It is to be noted that these processes may need skills and techniques. The processes are such as below:

· Evaluation of the windows swap file.

· Evaluation of the slack file.

· Evaluation of unallocated space or erased files.

· Searching of files, file slack and unallocated space for key words.

· Documenting file names, dates and times.

· Identifying the file, program and storage anomalies.

· Evaluation of the functionality of the program.

Findings documentation.

The documentation also includes documenting all software used in this process. Doing documentation for all findings is important so that they can be easily found and identified. For the software, make sure you use original software not pirated software. This is to avoid the evidence used to be questioned in presenting the case and this will give advantages to the other side.

POSTED BY SITI ZUBAIDAH HELMATERLIDI

3.0 Computer Evidence: Processing Process

2009-08-24T03:26:00.002+08:00

According to the International Organization on Computer Evidence, there are some principles that must be applied in order to recover digital evidence. The must apply principles are as follow:

All digital evidence will apply the same general rules as evidence.
The evidence must not be changed upon the process to seize the digital evidence. Precautions must be taken.
Only a trained person can access to the original evidence when needed.
Any activity to the evidence such as seizure, storage, access or travel must be documented, preserved and made available for review.
The responsibility of the evidence is upon the person who possessed it at the time.

Taking precautions.

Document the physical evidence.

eg:

Name:

Description:

Location:

Date:

Time:

Signature:

Shut down the computer.

Document the system’s hardware configuration.

Relocating the computer to a secured location.

Backups the hard disks and floppy disks.

The system data and time is to be documented.

Using key search words.

It is hard for a computer specialist to manually view each and every file on the hard disk. There is software which can help you make a list of key search words to help make your work more efficient.

.The processing of evidence.

It is to be noted that these processes may need skills and techniques. The processes are such as below:

· Evaluation of the windows swap file.

· Evaluation of the slack file.

· Evaluation of unallocated space or erased files.

· Searching of files, file slack and unallocated space for key words.

· Documenting file names, dates and times.

· Identifying the file, program and storage anomalies.

· Evaluation of the functionality of the program.

Findings documentation.

POSTED BY: SITI ZUBAIDAH HELMATERLIDI

4.1 Comparison between physical evidence and cyber evidence

2009-08-23T11:04:00.005+08:00

As mentioned earlier, evidence is defined as anything that is produced in court by the parties involved in order to testify the truth or falsity of the facts in a particular case. According to the Malaysian Administrative Modernisation and Management Planning Unit, evidence can be devided into few categories namely the direct evidence which is the oral testimony by the witness for instance eyewitness statement which contains proof.

Secondly is the documentary evidence which can be presented in the form of written or printed documents. Usually, computer crime cases use documentary evidence as the evidence of the case. Next is the demonstrative evidence which is basically the type of evidence that can be seen in the form of a model, experiment, chart, or an illustration. Another type of evidence is the real evidence which is also known as associative or physical evidence. Physical evidence is any evidence which is produced in court in form of physical object or objects which shows that a crime has been committed. This type of evidence is very important as it can link the investigators to a conclusion by looking at the characteristics of the object. Last but not least is the computer generated evidence or known as cyber evidence. For example, the visual output on the monitor, printed evidence on a printer/plotter, film recorder which includes magnetic representation on disk and optical representation on CD, and lastly, the data and information stored electronically on storage devices such as pen drive, CD or even diskettes.

However, for the purpose of this topic, we will focus only on the physical evidence and also cyber evidence where we compare between these two types of evidences. Various definitions can be seen from various experts on physical evidence. According to John Beech and Simon Chadwick, physical evidence can be defined as the tangible evidence of a service, including everything which can be seen, touched, smelt and heard. Secondly, according to 1st Class Investigations Inc., physical evidence is anything that may be found by investigators, to have a connection with a crime. Another definition regarding physical evidence is that any object that can provide information during the investigation. Initially, physical evidence includes many types of evidence such as finger prints, blood, semen, DNA, weapons and many more. Physical evidence can be found at the crime scene and it can establish that a crime has been committed. Sometimes it can also provide a link between a crime and its victim or between a crime and its perpetrator.

For instance, in a murder case, the DNA and fingerprints left by the attacker can be traced on the victim’s body, the blood splattered on the floor, the weapon used or even the footprints on the floor. According to Henry C. Lee and Howard A. Haris, physical evidence can be divided into four types namely transient, pattern, conditional and transfer. Transient is the physical evidence that is temporary in nature and can be easily change or lost for instance odor, temperature, imprints and indentations and lastly markings. This category of physical evidence must be collected, recorded and documented as soon as possible to avoid the loss of the evidence. Secondly is pattern evidence where it is the evidence that had been produced by force, direct contact between persons and objects or even the objects with other objects. The examples of pattern evidence are blood splatter patterns, glass fracture patterns, fire burning patterns and many more. Next is the conditional evidence where it is produced by certain occurrence. If this evidence is wrongly documented, it may cause such lost or changes. This type of physical evidence is very crucial to the crime scene reconstruction.

For instance, the condition of the light during the accident, the colour of the fire when it burns at the time of the accident, the direction of the burning flame and many more. Lastly, the classical type of evidence, the transfer evidence where this evidence is created by the physical contact between persons, objects, or between person and objects. There are many classifications that had been made according to its particular criteria. The examples for transfer evidence are blood, saliva, semen, fingerprints and many more. In order to determine the identity, common standard tests are used. Some of the evidence may require only one test but some may require more. The advantage of physical evidence is that it cannot be easily removed, modified or duplicate as the evidence such as fingerprints will remain permanently unless the perpetrator took some precautions by using gloves but sometimes they did not realize they had acted carelessly and leaving the some prints behind. The next advantage is that, by obtaining the objects at the crime scene which has fingerprints or DNA on it, it is easier for the investigators since it will link them straight to the suspect. In addition, the process of testifying the evidence does not need any specialization or expertise regarding computer like what is needed for the computer forensic. Thus, the complexity of the process is lower. Fourthly, the process of testifying the evidence does not require the spending of a large sum of money to pay the investigators since it does not necessitate special skill to testify the evidence.

Cyber evidence or also known as electronic evidence can be defined as all information which is generated, stored, transmitted using the electronic technology, the computer or other related technology and equipment that can provide explanations regarding the crime committed. The process or scientific method in extracting, gathering, processing and interpreting the cyber evidence in order to find a conclusion regarding the crime committed is called cyber forensic. There are many challenges in doing so since the accuracy and reliability of the evidence should be preserved and guaranteed in order to be presented to the court. Evidence obtained from a computer-related crime differs from the traditional form of evidence. This is because in most cases, the cyber evidence is intangible. Therefore, it is more fragile as compared to the physical evidence. Furthermore, the scope of cyber evidence is wider and the contents are easily modified, duplicated and it is more accessible. Questions arise regarding the validity of the evidence. However, there are cases which produced the cyber evidence before the court in order to prosecute the accused but it involves a very complex process.

For instance, if there is a case where the evidence can only be obtained from the computer, an expert should be called to obtain and testify the evidence as not all people has the skill that can operate the computer efficiently. By using the experts, not only it will create a difficulty since the number of experts in our country is very little as compared to other developing countries but it will also results the spending of a large sum of money to pay the experts. Hence, it is a waste for our country as the money can be used for other purposes which are more crucial. For some, they consider it as a weakness for using cyber evidence but for unknown author, she considers it to be an advantage. Since it involves the basis of high-tech technology, it makes the traces of modification cannot be easily noticed and take hold by ordinary people to make changes and the modification. Only experts can easily detect the modification made by the perpetrator. Thus, it shows the stability in using this kind of evidence. However, in our personal opinion, we disagree with the view given by the unknown author after taking into consideration many factors such as the cyber evidences are easily modified, duplicated and accessible, it does not maintain the originality and authenticity of the evidence. Thus, it will create doubt.

As a result, the strength of this cyber evidence is lesser as compared to the physical evidence where according to Paul L.Kirk, a forensic scientist who was awarded the criminalistics section of the American Academy of Forensic Sciences,

“This is evidence that does not forget. It is not confused by the excitement of the moment. It is not absent because human witnesses are, it is factual evidence, physical evidence cannot be wrong, it cannot perjure itself...only its interpretation can."

Various opinions and views were given by various people regarding this issue but for the purpose of this course, we concluded that the strength of physical evidence is greater as compared to cyber evidence as physical evidence cannot be easily removed, modified or duplicate, the collection of evidence will link them straight to the suspect, the process of testifying the evidence does not need any specialization or expertise regarding computer, the complexity of the process is lower and lastly, the process of testifying the evidence does not require the spending of a large sum of money to pay the investigators since it does not necessitate special skill to testify the evidence.

POSTED BY; FARINA BINTI MOHAMAD YAHYA

5.0 Computer Evidence in Malaysia

2009-08-22T23:04:00.003+08:00

5.1 INTRODUCTION

In 1991, the Working Paper, The Way Forward – Vision 2020, was presented by His Excellency YAB Tun Dr Mahathir Mohamad at the Malaysian Business Council; when he was the Prime Minister of Malaysia. The ultimate objective of this paper is for Malaysia to be a fully developed country by the year 2020.1

In his speech, he had laid-out the nine central strategic challenges that Malaysians have to overcome in order to reach the objective of the paper. The sixth challenge is to establish a scientific, progressive; innovative and forward-looking society who is not only a consumer of technology but also a contributor to the scientific and technological civilisation of the future.2

5.1.1 Evidence Act 1950 (Act 56)

Evidence Act 1950 governs the matters pertaining to evidence, whether in criminal or civil cases, which proceedings took place in or before the Malaysian courts, as according to Section 2 of the discussed Act.

Following the launch of Vision 2020 by the former Prime Minister, the Evidence Act 1950 has been amended to adept to computer-related crimes and online environment. Major amendement was made by the promulgation of Evidence (Amendment) Act 1993 to aid the rising need to officially acknowledge computer evidence in judicial proceedings.3

The Evidence (Amendment) Act 1993 consists of eight amendments to the Evidence Act 1950. However, not all amendments are relevant to computer evidence.4

The amendments related to computer evidence are:

Section 3

Definition of "computer" and "document" was inserted into Section 3 along with Illustrations for the word "document".

“computer” means any device for recording, storing, processing, retrieving or producing any information or other matter, or for performing any one or more of those functions, by whatever name or description such device is called; and where two or more computers carry out any one or more of those functions in combination or in succession or otherwise howsoever conjointly, they shall be treated as a single computer;

“document” means any matter expressed, described, or howsoever represented, upon any substance, material, thing or article, including any matter embodied in a disc, tape, film, sound track or other device whatsoever, by means of—

(a) letters, figures, marks, symbols, signals, signs, or other forms of expression, description, or

representation whatsoever;

(b) any visual recording (whether of still or moving images);

(c) any sound recording, or any electronic, magnetic, mechanical or other recording whatsoever and howsoever made, or any sounds, electronic impulses, or other data whatsoever;

(d) a recording, or transmission, over a distance of any matter by any, or any combination, of the means mentioned in paragraph (a), (b) or (c), or by more than one of the means mentioned in paragraphs (a), (b), (c) and (d), intended to be used or which may be used for the purpose of expressing, describing, or howsoever representing, that matter;

ILLUSTRATIONS

A writing is a document.

Words printed, lithographed or photographed are documents.

A map, plan, graph or sketch is a document.

An inscription on wood, metal, stone or any other substance, material or thing is a document.

A drawing, painting, picture or caricature is a document.

A photograph or a negative is a document.

A tape recording of a telephonic communication, including a recording of such communication transmitted over distance, is a document.

A photographic or other visual recording, including a recording of a photographic or other visual transmission over a distance, is a document.

A matter recorded, stored, processed, retrieved or produced by a computer is a document.

Section 60(3)

Recognition of computer related evidence as documentary evidence.

60. (3) If oral evidence refers to the existence or condition of any material thing including a document, the court may, if it thinks fit, require the production of that material thing or the document for its inspection.

Explaination 3, Section 62

Recognition of evidence produced by a computer as a primary evidence.

Explanation 3—A document produced by a computer is primary evidence.

Section 90A

Regarding admissibality of documents produced by a computer and everything within the documents as a valid evidence in civil and criminal proceedings if it was produced by the computer in the course of it's ordinary use.5 The person who is responsible to the use of the computer that produced the evidence must signed a certificate that the computer was used in the course of it's ordinary use.

90A. Admissibility of documents produced by computers, and of statements contained therein

(1) In any criminal or civil proceeding a document produced by a computer, or a statement contained in such document, shall be admissible as evidence of any fact stated therein if the document was produced by the computer in the course of its ordinary use, whether or not the person tendering the same is the maker of such document or statement.

(2) For the purposes of this section it may be proved that a document was produced by a computer in the course of its ordinary use by tendering to the court a certificate signed by a person who either before or after the production of the document by the computer is responsible for the management of the operation of that computer, or for the conduct of the activities for which that computer was used.

(3) (a) It shall be sufficient, in a certificate given under subsection (2), for a matter to be stated to the best of the

knowledge and belief of the person stating it.
(b) A certificate given under subsection (2) shall be admissible in evidence as prima facie proof of all matters stated in it without proof of signature of the person who gave the certificate.

(4) Where a certificate is given under subsection (2), it shall be presumed that the computer referred to in the certificate was in good working order and was operating properly in all respects throughout the material part of the period during which the document was produced.

(5) A document shall be deemed to have been produced by a computer whether it was produced by it directly or by means of any appropriate equipment, and whether or not there was any direct or indirect human intervention.
(6) A document produced by a computer, or a statement contained in such document, shall be admissible in evidence whether or not it was produced by the computer after the commencement of the criminal or civil proceeding or after the commencement of any investigation or inquiry in relation to the criminal or civil proceeding or such investigation or inquiry, and any document so produced by a computer shall be deemed to be produced by the computer in the course of its ordinary use.
(7) Notwithstanding anything contained in this section, a document produced by a computer, or a statement contained in such document, shall not be admissible in evidence in any criminal proceeding, where it is given in evidence by or on behalf of the person who is charged with an offence in such proceeding the person so charged with the offence being a person who was—
(a) responsible for the management of the operation of that computer or for the conduct of the activities for which that computer was used; or
(b) in any manner or to any extent involved, directly or indirectly, in the production of the document by the computer.

Section 90B

Regarding weight of the document or statement in the document as evidence that was accepted in virtue of Section 90A.

90B. Weight to be attached to document, or statement contained in document, admitted by virtue of section 90A

In estimating the weight, if any, to be attached to a document, or a statement contained in a document, admitted by virtue of section 90A, the court—

(a) may draw any reasonable inference from circumstances relating to the document or the statement, including the manner and purpose of its creation, or its accuracy or otherwise:

(b) shall have regard to—

(i) the interval of time between the occurrence or existence of the facts stated in the document or statement, and the supply of the relevant information or matter into the computer; and
(ii) whether or not the person who supplies, or any person concerned with the supply of, such information or the custody of the document, or the document containing the statement, had any incentive to conceal or misrepresent all or
any of the facts stated in the document or statement.

Section 90C

Section 90A and 90B prevails over Bankers' Book (Evidence) Act 1949 and all other written law.

90C. Sections 90A and 90B to prevail over other provisions of this Act, the Bankers’ Books (Evidence) Act 1949, and any written law
The provisions of sections 90A and 90B shall prevail and have full force and effect notwithstanding anything inconsistent therewith, or contrary thereto, contained in any other provision of this Act, or in the Bankers’ Books (Evidence) Act 1949 [Act 33], or in any provision of any written law relating to certification, production or extraction of documents or in any rule of law or practice relating to production, admission, or proof, of evidence in any criminal or civil proceeding.

SOURCE

1996. Complete Text of the Working Paper - The Way Forward presented by His Excellency YAB Dato' Seri Dr Mahathir Mohamad at the Malaysian Business Council. The Way Forward - Vision 2020. 1. (online) http://www.wawasan2020.com/vision/index.html (20 August 2009).
1996. Malaysia As A Fully Developed Country - One Definition. The Way Forward - Vision 2020. 4. (online) http://www.wawasan2020.com/vision/p2.html (20 August 2009)
Mohamad Rizal bin Abd Rahman. 2009. RELEVANT ICT LEGAL MECHANISMS IN MALAYSIA. <i>Dr Shimaa Atallah, Forum for All Lawyers. 1. (online) http://www.shaimaaatalla.com/vb/showthread.php?p=9294 (20 August 2009).
ibid.
ibid.

POSTED BY NADHIRAH NA’IEMAH

5.2 Classification of Computer Evidence

2009-08-22T22:05:00.002+08:00

5.2 CLASSIFICATION OF COMPUTER EVIDENCE1

According to Toh See Kiat, computer evidence can be classified into five categories.2

Computer-printed evidence

direct mechanical production of the computer's contents in a visible counterpart (eg: printed on paper).

Computer-stored evidence

records kept in machine-readable form, or in the computer's memory devices including data stored on various types of media including secondary storage media like WORM3 disks.

Computer-noted evidence

printouts and other computer-output from automatic data recorders and other automatic machine including automatic logs and journals mentioned in computer-printed evidence; and encryption of text.

Computer-created evidence

products of fifth generation computers processing 'artificial intelligence4 and 'fuzzy logic'5
computer models, stimulations and forecasts, including purchase orders generated automatically by the computer when it 'decides' to order when stocks run low.

Computer-transmitted evidence

refers to computer-printed and computer-noted evidence being transmitted to distant location.
includes purchase orders, remittance advices, payment orders, customs declarations, transmitted and received between trading company and its suppliers.
there is an automatic system which logs the incoming message, perhaps on an activity journal, and stores on non-eraseable media.

SOURCE

Lee Swee Seng. 2005. Electronic Evidence in Malaysia. In Zaid Hamzah (author). E-Security Law & Strategy, page 146-147. Malaysia: Malayan Law Journal.
Toh See Kiat. 1992. Paperless International Trade: Law of Telematic DataInterchange. Singapore: Butterworth Asia.
‘Write Once, Read Many: a data storage technology that allows information to be written to a disc a single time and prevents the drive from erasing the data. The discs are intentionally not rewritable, because they are especially intended to store data that the user does not want to erase accidentally.’

2008. What is WORM (write once, read many)?. Whatis.com. 1. (online) http://searchstorage.techtarget.com/sDefinition/0,,sid5_gci966680,00.html (21 August 2009)
'Artificial Intelligence: An attempt to model aspects of human thought on computers. It is also sometimes defined as trying to solve by computer any problem that a human can solve faster.’

2005. Artificial Intelligence: AI. The History of Computing Project. 1. (online) http://www.thocp.net/reference/artificial_intelligence/ai.htm (22 August 2009)
'Fuzzy Logic: problem-solving control system methodology that lends itself to implementation in systems ranging from simple, small, embedded micro-controllers to large, networked, multi-channel PC or workstation-based data acquisition and control systems.'

D. Kaehler, Steven. Fuzzy Logic Tutorial.Seattle Robotics Society. 44. (online) http://www.seattlerobotics.org/Encoder/mar98/fuz/flindex.html (22 August 2009).

POSTED BY NADHIRAH NA’IEMAH

5.3 Weight of Evidence

2009-08-22T21:11:00.001+08:00

5.3 WEIGHT OF EVIDENCE1

The weight of evidence is based on the believability or persuasiveness of evidence. Particular evidence has different weight in inducing belief regarding to the facts and circumstances to be proved. Evidence that is undetermined, imprecise, or doubtful will be given less weight than evidence that is direct and un-refuted. For example, a criminal defendant's testimony that he had never been at the scene of a crime would be given little weight if his fingerprints were found at the crime scene and witnesses testify they saw him at the scene. Similarly, evidence given by a witness who testifies from personal observation is of greater weight than evidence offered by a witness who is testifying from general knowledge alone.2

Section 90B of the Evidence Act 1950 deals with weight to be attached to document or statement contained in a document, admitted under Section 90A of the same act.

The court have the power to determine the weight of the evidence by looking into the circumstances relating to the evidence. It also can take into account the time of occurrence or existence of the document and the supply of the relevant matter to the computer and whether the supplier of the document or the document itself has any incentive to conceal or misinterpret the information stated in the document or statement; in determining the weight of the evidence.

The parties who wants to use the document or statement in a document as evidence in court should show that there is a minimal risk of alteration and corruption to the document. Matters regarding the security procedures available and any possibility of unauthorized access will be considered in determining the authenticity of the document. In determining the accuracy of the statements contained in an electronic transmission, the possibility of the message being corrupted by the computer transmission shall be considered.

The existence of technology such as encryption, codes or call-back verification procedures can be used to verify the authenticity of documents or statements in a document produced by a computer that is presented as evidence in the court.

SOURCE

Lee Swee Seng. 2005. Electronic Evidence in Malaysia. In Zaid Hamzah (author). E-Security Law & Strategy, page 149-150. Malaysia: Malayan Law Journal.
2009. Weight of evidence legal definition of Weight of evidence. Weight of Evidence synonyms by The Free Online Dictionary. The Free Dictionary by Farlex. 1. (online) http://legal-dictionary.thefreedictionary.com/Weight+of+evidence (21 August 2009).

POSTED BY NADHIRAH NA’IEMAH

5.4 Primary and Secondary Evidence

2009-08-22T20:14:00.003+08:00

5.4 PRIMARY AND SECONDARY EVIDENCE

Is computer evidence a primary or a secondary evidence?

Primary evidence is an authentic document or item that is offered as proof in a lawsuit. Sometimes, it can be incorrect, or contain minor errors, but this is rare.1 If primary evidence is available to a party, that person must offer it as evidence. However, if primary evidence is unavailable through no fault of the party, he or she may present a reliable substitute for it once it’s unavailability is sufficiently established.2

Secondary evidence differs from primary evidence. It is evidence that has been reproduced from an original document or substituted for an original item. For example, a photocopy of a document would be considered secondary evidence.3 Secondary evidence is usually admitted upon failure to obtain the primary evidence.4

Courts prefer primary evidence because it is the actual item. They try to avoid using secondary evidence wherever possible. This approach is called the best evidence rule.

Section 64 of the Evidence Act 1950 provides that documents must be proved by primary evidence except in cases under Section 65. On the other hand, Explanation 3 of Section 62 clearly states that a document produced by a computer is a primary evidence.

Section 90A Evidence Act 1950 applies to computer evidence. Subsection (5) of the aforementioned section clarifies the fact that a document shall be deemed to have been produced by a computer whether it is produced directly by a computer or by any means of appropriate equipment such as a printer without the need of any human intervention, direct or otherwise.

SOURCE

2009. Primary Evidence. martygrant.com. 1. (online) http://www.martygrant.com/gen/refs/primary.htm (21 August 2009)
2009. Primary Evidence. Law Library - American Law and Legal Information. 1. (online) http://law.jrank.org/pages/9375/Primary-Evidence.html (21 August 2009)
2009. Definition: Secondary Evidence. Amanda Graham’s Web Page and Circumpolar Info Centre.... 1. (online) http://www.yukoncollege.yk.ca/~agraham/guides/second.htm (21 August 2009)
2009. Secondary Evidence: West's Encyclopedia of American Law. eNotes.com. 1. (online) http://www.enotes.com/wests-law-encyclopedia/secondary-evidence (21 August 2009)

POSTED BY NADHIRAH NA’IEMAH

5.5 Burden of Proof

2009-08-22T20:00:00.004+08:00

5.5 BURDEN OF PROOF

In virtue of Section 103 of the Evidence Act 1950, the burden of proof as to any particular fact lies on the party who wishes the court to believe its’ existence. Whereby, Section 106 provides the burden of proof lies on the person who has the knowledge of the actual fact (primary evidence).1

In PEINet v. O'Brien [1995] P.E.I.J. No. 68, a Canadian case, MacDonald C.J. delivering the judgement, dismissed the plaintiff's application because the plaintiff has failed to authenticate the evidence presented to the court.

SOURCE

Lee Swee Seng. 2005. Electronic Evidence in Malaysia. In Zaid Hamzah (author). E-Security Law & Strategy, page 150. Malaysia: Malayan Law Journal.

POSTED BY NADHIRAH NA’IEMAH

5.6 Malaysian Decided Cases

2009-08-22T19:27:00.000+08:00

5.6 CASES

Citibank Berhad v Titik Juta Sdn Bhd [2008] MLJU 0437

In virtue of Section 2 of the Evidence Act 1950, the court held that the Act is not applicable regarding affidavits brought up in proceedings. The court follows the decision made in Muthukrishnan a/l Suppiah v Menteri Hal Ehwal Dalam Negeri & Anor [1994] 3 AMR 2259, Re Ong Thim Kuang [2000] 5 MLJ 442, Southern Finance Bhd. v Sun City Development Sdn. Bhd. & anor [2006] 6 MLJ 673 and Riedel- De Haen Ag v Liew Keng Pang [1989] 2 MLJ 400.

Hanafi bin Mat Hassan v Public Prosecutor [2006] 4 MLJ 134

The accused was charged in the High Court with rape and murder of the deceased on 7 October 2000. It was alleged that the accused raped and murdered the deceased while she was travelling in the bus driven by the accused. Learned counsel for the accused submitted that the evidence presented by the prosecution was inadmissible, because (i) the bus ticket produced by a ticket machine in a bus belonging to the bus company of the accused was inadmissible for failure of the prosecution to tender a certificate pursuant to Section 90A(2) of the Evidence Act 1950; and (ii) summary of the DNA profiling result was also inadmissible for non-compliance with Section 90A.

The court dismissed the appeal and found the accused guilty of both charges (murder and rape).

Augustine Paul JCA had dispensed with the need to tender in evidence the certificate required by Section 90A(2) as there was evidence to show that the ticket machine was a computer and that the ticket was produced in the ordinary course of business of the ticket machine. The presumption in Section 90A(6) was sufficient to establish the latter element even in the absence of evidence from the witness to show that the ticket was produced by the machine in the ordinary course.

The learned judge agreed with DPP's arguments that in order to tender bus ticket as evidence, it was sufficient for him to rely on Section 90A(1) read with the definition of 'computer' as found in Section 3 of the Evidence Act. The trial judge found that the bus ticket machine fits in the definition of 'computer'.

The failure of the prosecution to tender a certificate pursuant to Section 90A(2) is irrelevant in this case. The use of the words 'may be proved' in Section 90A(2) indicates that the tendering of a certificate is not a mandatory requirement in all cases but it is permissive.

Furthermore, there were also oral evidence by witnesses that both the bus ticket machine and the DNA analyser is working in their course of ordinary use.

Therefore, even without a certificate to prove the authenticity of the bus ticket, Section 90A(6) of the Evidence Act deems the ticket to be produced by the ticket machine in the course of its ordinary use. He based his decision on the judgment of the Court of Appeal in Gnanasegaran a/l Pararajasingam v Public Prosecutor [1997] 3 MLJ 1. Accordingly, the learned judge admitted the ticket and the DNA report in evidence.

Ahmad Najib bin Aris v Public Prosecutor [2009] 2 MLJ 613

The appellant was convicted of rape and murder in the High Court. The appellant appealed to the Court of Appeal. The significant issues, inter alia, concerned the admissibility of documents produced by a computer pursuant to Section 90A of the Evidence Act 1950.

The court held that a certificate under Section 90A(2) of the Evidence Act is not the only method to prove that a document was produced by a computer 'in the course of its ordinary use' under Section 90A(1). Section 90A(6) deals with the admissibility of a document which was not produced by a computer in the course of its ordinary use and is only deemed to be so. The fact that a document was produced by a computer in the course of its ordinary use may be proved by the tendering in evidence of a certificate under Section 90A(2) or by way of oral evidence. Such oral evidence must consist not only of a statement that the document was produced by a computer in the course of its ordinary use but also of the matters presumed under Section 90A(4). The presumption contained in Section 90A(6) could be resorted to only when the document was not produced by a computer in the course of its ordinary use, following the decision in Hanafi Mat Hassan v Public Prosecutor [2006] 4 MLJ 134

In this case, no certificate was tendered under Section 90A(2) for proof of the chemist report. Further, no oral evidence was adduced to show that the report was produced by a computer. However, the report could be presumed to be produced in the course of the computer's ordinary use under Section 90A(6). Proof of the matters referred to under Section 90A(4) was also adduced through the evidence of a witness. The chemist report, which directly linked the appellant to the commission of the crimes charged, was thus admissible.

However, although CCTV tapes were documents produced by a computer by virtue of the definition ascribed to the words 'document' and 'computer' under Section 3 of the Act, it did not satisfy the requirements of Section 90A. Therefore, they were inadmissible as evidence.

Zulkefli FCJ, delivering the judgement of the court, dismissed the appeal.

POSTED BY NADHIRAH NA’IEMAH

6.0 Article, View and Comment, by HIDAYAT

2009-08-20T09:23:00.003+08:00

Article:Undercover chatroom work captures e-criminal.(Barrett Lyon, National Hi-Tech Crime Unit).

Investigative work by a US computer forensic specialist helped lead the National Hi-Tech Crime Unit and the FBI to a Russian gang responsible for launching denial of service attacks against online betting sites in a multimillion-pound extortion attempt last year.

Barrett Lyon, a specialist in preventing denial of service attacks, posed for months as a computer criminal to infiltrate a Russian crime syndicate which had brought down online gambling and retail sites.

His work helped detectives at the National Hi-Tech Crime Unit secure the arrest of a 21-year-old Russian mechanical engineering student Ivan Maksakov last year.

The investigation unraveled one of the most high-profile internet crime syndicates and set the scene for four further arrests, it emerged last week.

Lyon, now chief technology officer at Prolexic, which specialises in defending firms against denial of service attacks, used specially developed software to trace and monitor "bot nets" of hacked PCs used for the attacks.

"We located the bot nets because our systems took the attacks on behalf of customers. With all the information we gathered, we posed as bot nets ourselves," he said.

A breakthrough came when Lyon and his colleagues found details of the chat channel used by the gang hidden in bot net software downloaded from an infected machine. It emerged the gang was using internet relay chat to talk to each other and to control up to 80,000 bot nets.

"We were on the chatrooms where they were controlling the bots from, watching them talking about who they were going to attack next," he said.

Lyon posed as a hacker and, over the next few months, earned the trust of the criminals and built up a profile of them.

The gang remained out of reach until Maksakov made the mistake of logging into an internet chat session in March 2004 using his own IP address. Lyon traced Maksakov's address and phone number in Russia and sent off an urgent e-mail to the Hi-Tech Crime Unit.

"Ivan was the name that was given to us via exe during ICQ chat. His last name, address and phone number are now known."

Source Citation:Goodwin, Bill. "Undercover chatroom work captures e-criminal." Computer Weekly (April 5, 2005): 8. Computer Database. Gale. Universiti Kebangsaan Malaysia. 27 Aug. 2009

VIEW AND COMMENT

Based on this article, basically it is a news about a succeed investigation conducted by a computer expert named Barrett Lyon, who is also a chief technology officer at Prolexic. His investigation had led a captured of a Russian gang who was responsible for launching denial of service attacks against online betting sites in a multimillion-pound extortion attempt before this.

The method used by Lyon was developed software, which can trace and monitor "bot nets" of hacked PCs used for the attacks. After Lyon located the bot nets later, he himself had posed as bot nets. He also posed as a hacker and earned the trust of the criminals and built up a profile of them. Until one day, the criminal made the mistake by logging into an internet chat session using his own IP address and he was traced. The criminal behind this was a 21-year-old Russian mechanical engineering student, named Ivan Maksakov.

There are few things that I would like to comment about. The first one is the criticality of cyber crime nowadays. We can see that how the criminal had launched denial of service attacks against sites, and take control of 80 000 bot nets, in order to deny the victims access to a particular resources.

Besides that, we should take notes that denial of service attacks can essentially stop your computer and network. It also may cause effectively havoc situation in the organization attacked. In brief conclusion, cyber crime is very dangerous and caused tones of problems when it occurred. So any way to stop the cyber criminal is a must.

The second point, I would like to highlight is, the importance of experts in this field. As we know, cyber crimes rates increasing each year, and so many types of crimes had been developed. So, it is a suggestion, for government of every country to be alert and take action by providing ways to train people in this field. It is vital for creation of software, programs and application to protect and also oppose against cyber crimes.

Last but not least, we should take into account that, most of cyber crimes include the youth. This is a serious matter; because it showed us through cyber there the youngster can commit serious offence. And should law still protect them? Should judge use their discretionary power in this matter? Question left unanswered.

POSTED BY; NURUL HIDAYAT BINTI AB RAHMAN

6.0 Article, View and Comment, by NA'IEMAH

2009-08-19T13:30:00.102+08:00

Article: Schoolteacher granted new trial in spyware-porn case; Computer-forensic evidence could keep Amero out of jail.(Julie Amero).

Connecticut schoolteacher Julie Amero, convicted in a classroom computer-porn incident she says happened because spyware took over the computer at her desk; today was granted a new trial instead of a possible jail term. Amero, a substitute teacher, had faced a possible 40-year jail term related to her conviction last January on four counts of risk to a minor pertaining to the porn-image pop-ups that students at Kelly Middle School saw on Oct. 19, 2004, on the computer at her desk.

But instead of sentencing Amero today, as had been scheduled, New London Superior Court Judge Hillary Strackbein granted the request filed yesterday by Amero's defense lawyer William Dow III for a new trial based on additional computer-forensic evidence he has shared with the state.

In Connecticut, the Norwich Bulletin reported today Amero that said she "felt very comfortable with the decision" to be granted another trial to defend herself, and that state prosecutor David Smith also said forensic evidence presented during Amero's first trial may have included some "erroneous information."

The case of Amero, who has protested her innocence from the start and blamed spyware for taking over her computer for the pornographic images that students saw, has attracted attention among IT managers at school districts across the country.

Some IT managers, such as Tom Sims, director of network services for Miami-Dade Public Schools, have said it's not out of the question to imagine that Amero's computer was infected by spyware.

The case has also caught the attention of antispyware industry experts, some who have been quietly contributing their expertise in malware detection and forensics behind the scenes to assist Amero in her defense. Alex Eckelberry, president of Sunbelt Software, says computer forensics expert Dr. Glenn Dardick, along with individuals from security firms Sunbelt, MessageLabs and SecureWorks, have lent their expertise in the Amero case.

"Obviously, I'm very pleased at the outcome," Eckelberry says, alluding to Amero's chance at a second trial. That trial has not yet been scheduled.

Source Citation: Messmer, Ellen. "Schoolteacher granted new trial in spyware-porn case; Computer-forensic evidence could keep Amero out of jail.(Julie Amero)." Network World (June 6, 2007): NA. Computer Database. Gale. Universiti Kebangsaan Malaysia. 27 Aug. 2009

View and Comment

This article is about the case of Julie Amero, a substitute teacher who was facing four charges of risk to a minor after students at the school saw porn-image pop-ups on the classroom-computer on her desk. Usually, such pop-ups will only comes up if the user of the computer has viewed porn-sites or any unappropiate sites. Therefore, it was concluded at the beginning of the case that Amero has misused the classroom-computer in an unappropiate way.

However, later on, based on the article, it is clear that this kind of things can happen even though the user of the computer has never viewed or clicked on unappropiates sites. Although at the first-trial the computer-evidence found indicated that Amero was guilty of the aforementioned charges, further investigation and research resulted in findings of new computer-evidence that may lead elsewhere.

The newly found computer-evidence might affirmed Amero's claim that the classroom-computer was infected by spyware resulting in the existence of the porn-image pop-ups at the computer's browser. Even experts in Information Technology area did not left-out the possibility that the computer might be infected by spyware which may altered the system of the computer.

This shows that computer-evidence is a very fragile thing and it may easily be broken or modified whether by humans or viruses and spywares. It proves that, although this kind of situation is rare, sometimes, what was supposed to be primary evidence can be incorrect or contain minor errors.

In my opinion, with the increasing importance of computer-evidence in court, experts must work in full speed and do more research to establish better anti-spyware or anti-virus softwares in order to protect the computer's system. This is a critical problem because if incorrect evidence was presented in the court and nobody can detect the incorrectness of the evidence, innocent people may be punished.

Furthermore, if this problem is not curb as soon as possible, the credibility of computer-evidence might be in jeapordy. If that happens, many cases will be left unsolved because nowadays, computer has become part and parcel of the society. Computer-evidence is used in civil and criminal cases. If it's not useable because of the increasing risk of modification by spywares and viruses, justice system will cripple especially in cyber crime cases.

In conclusion, computer-evidence is always at risk of alteration by humans or viruses and spywares. Therefore, experts must come up with better protection for the computer system in order to persevere the evidence that can be extracted from the computer.

POSTED BY NADHIRAH NA'IEMAH

6.0 Article, View and Comment, by ZUBAIDAH

2009-08-18T12:35:00.001+08:00

Article:Scotland Yard to set up crack cybercrime unit.(Bill Goodwin)

Scotland Yard police chiefs are considering plans to create a computer crime unit of up to 25 detectives to investigate hacking and virus attacks against businesses in London and to provide specialist computer forensic services throughout the Metropolitan Police. The proposed unit, to be formed by merging five existing computer crime operations across the Met, will create a single team of computer crime specialists, second only to the National High-Tech Crime Unit, which focuses on major organised crime. The plan comes as the Met's existing computer crime unit, which will form the heart of the new operation, faces increasing pressure to provide support for paedophile and anti-terrorist work in addition to investigating a rising tide of hacking complaints. Detective inspector Clive Blake, acting head of the unit, said his nine-strong team was "stretched" and having to work evenings and weekends to keep up with the volume of work. He believes a single unit could help the Met work more efficiently.

"This is an entirely personal opinion but, looking at what the FBI and the US secret service have been doing, it would make sense to have a large, multitasking team, with an operational cell and an intelligence cell in a self-contained unit."

Well-funded organised crime syndicates are beginning to move into computer crime and are hiring hackers to break into firms' computer systems to gather intelligence on their intended victims, Blake said.

In comparison, the Met's computer crime unit, which lacks its own budget, is considered poorly resourced. It has been forced to ask suppliers to donate sophisticated equipment needed for investigations free of charge under the Met's sponsorship scheme.

Peter Sommer, security expert at the London School of Economics, said, provided the proposals for a combined computer crime unit were not derailed by internal politics in the Met, the move could give police greater flexibility to investigate crime complaints.

"If you have a larger group, you have more flexibility and you can also have people who specialise. The larger the group of people, the more sense it makes to have people specialising in, say, computer networks."

Under the plans, the merged unit would bring together computer crime operations from Special Branch, the paedophile unit, the anti-terrorism division, and clubs and vice.

bill.goodwin@rbi.co.uk

London's cybercrime unit, p18

Source Citation:Goodwin, Bill. "Scotland Yard looks to set up crack cybercrime unit." Computer Weekly (March 13, 2003): 3(1). Computer Database. Gale. Universiti Kebangsaan Malaysia. 27 Aug. 2009

VIEW AND COMMENT

This article is generally on the effort of the police department in Scotland to set up a unit in order to curb the problem of overwhelming computer crime. The unit will provide the Metropolitan Police with a specialize computer forensic services. The main objective of the unit consisting of 25 detectives is to investigate hacking and virus attacks against businesses in London. We can see that the area is in a major need of such unit as the cyber crimes is increasing day by day causing interruption to the companies and firms. This unit will stand second behind the National High-Tech Crime Unit which function focused on major organized crime.

The set up is to help improves Mets which is facing lack of support for paedophile and anti-terrorist work. The acting head of the unit, Clive Blake said that the team has to work extra hours and very hard to keep up with the bundles of work they have and he welcomes any other help to decrease the burden of work. He added that the Federal Bureau of Investigation (FBI) and the United States Secret Service really need the help of a major team such as the cyber crime unit to assist them. we can see that this unit is beneficial to all departments and it comes just at the right time to assist those departments.

Hackers are being hired by well funded crime syndicates to attack the system of the firms and victimize them for their own criminal benefits. These organizations are much more funded in comparison to the Met's computer crime unit. The unit have to force the suppliers to provide them with high-technology equipment for their investigations. This shows that the problem is not just the workmen but also in their budget. If they have much more less technology equipments, how woul they stopped the crime syndicates which are much more well funded than them?

A security expert in London School of Economics stated that the unit will give more flexibility in investigating cyber crimes as the unit will provide more well-specialised experts and help reduce the number of cyber crimes complaints.

As a conclusion, we can say that the world is in a major need of more security in order to stop cyber crimes which can bring negative effects globally and to set up such a unit can help reducing them.

POSTED BY: SITI ZUBAIDAH HELMATERLIDI

6.0 Article: Experts Must Think Like Criminals To Track Computer Clues

2009-07-12T21:32:00.002+08:00

ARTICLE :Experts Must Think Like Criminals To Track Computer Clues.

No part of this information may be reproduced, republished or redistributed without the prior written consent of CMP Media, Inc.

It wouldn't surprise computer forensic expert Walt Manning if authorities were to find data about funding operations on PCs they seize during raids of suspected terrorists' homes. The retired Dallas police lieutenant says he's often seen it happen in criminal investigations. "We've had spreadsheets maintained by drug dealers that laid out their entire operation."

Financial data may just be the tip of the iceberg. Last fall, for instance, al-Qaida terrorists fleeing Kabul left behind a PC that contained hundreds of files that detail plots for assassinations and terror attacks.

While most evidence collected against terrorists probably won't be from seized or abandoned PCs, any information stored on such systems will come under close scrutiny. Investigators will rely on computer forensics, a technique to collect, analyze, and present data stored on a computer's hard disk that can be admitted as evidence.

They may have to think like criminals to find some of the data, Manning says. In addition to using encryption technologies, it's not unusual for criminals to burn incriminating evidence into the middle of a CD, with surrounding music tracks to hide the illicit data. Investigators who hear music might not bother to check the rest of the CD. And some lawbreakers no longer store data on their own PCs, so forensic computer experts must look for pointers on the computer to an online storage service the criminal may have employed.

Still, investigators can find evidence on PC hard drives. Files the user thinks are deleted often survive in unallocated areas of the drive. But computer forensic experts must be careful in how they access and duplicate data. "You need an exact duplicate [to present as evidence]. If the target drive has a bad sector, your copy must have a bad sector," Manning says. "You want to be able to swear under oath that nothing was altered." One of his favorite utilities is Guidance Software Inc.'s Encase, which allows the copying of a hard drive without altering files.

http://informationweek.com/

Source Citation:Chabrow, Eric. "Experts Must Think Like Criminals To Track Computer Clues." InformationWeek (Jan 14, 2002): 34. Computer Database. Gale. Universiti Kebangsaan Malaysia. 27 Aug. 2009

Summary

Nowadays there is nothing impossible or unusual for a computer forensic expert for instance Walt Manning, if he had been told that the authorities or to be specific the police finds the funding operations on the computers that they confiscate during the raids of suspected terrorists homes. There are many cases which results in the finding of various information. According to the retired Dallas police lieutenant, they had spread sheets maintained by drug dealers that laid out their entire operation.
A case that can illustrate the situation is the finding of a computer that contained hundreds of files regarding the assassinations and terror attack details by the al-Qaida terrorists which was left over behind after they flee to Kabul. However, this type of evidence collected from any abandoned or seized computer is not the most important source in obtaining the evidence. This is because the information is very important to them, thus, they will try to hide it as complicated and secretly as they could. Another example is on the latest case of Noordin Mat Top where the Indonesian police seized few laptops at their hiding place which was ambushed and caused the death of the Noordin himself.
This is when the computer forensic experts will exercise its skill which is to collect and analyze the data stored in the computer’s hard disk. There are so many ways in which the criminals used to store the information for instance the information regarding their group’s activities and also their future planning may be kept in an unexpected place such as in the middle of music tracks. Hence, when the investigators seized the cd and listen to it, he will not bother to check the rest of the tracks since he did not aspect the cd contains illicit data.
Fearing of their activities will be found out by the authorities, some criminals may no longer hide their important data in the hard disk. Therefore, the computer forensic experts must search for any clue that the criminals may use for instance online storage. For files that have been deleted by the user may be retrieved by the experts as the data is actually available and saved in an unallocated area. However, the experts must carry out their duty carefully and diligently so that the reliability of the data to be presented as evidence in court is unquestionable.
In our current situation, computer is part of our life as we crucially need it in various circumstances for instance to store data, send the data through email, modify the data and many more. It is not something new to our generation. The advancement of technologies by day to day is also coherent to the improvement of people’s skill in handling and managing the computer. Thus, the probability that the data will be saved in an unexpected manner is very high and that is why the investigators must think like the criminals in order to obtain the information.
In my opinion, the criminals nowadays are very creative in hiding the illicit data and also the means of escape. Actually, there are few factors which contribute to this matter but the most important factor is the exposure and the media influence. Nowadays, there are stories regarding crime solving for instance CSI and many more. Not to deny the story line are very interesting but these types of stories indirectly provide the idea to the criminals on how they should act and escape from the authorities. Although the main objective of these series is just to entertain the people, but, some may use it negatively for their own good.
In a conclusion, the experts must do a lot of research especially when it comes to the way the criminals think in order to make it easier for them to collect the illicit data which then leads to the criminal’s trail.
POSTED BY; FARINA MOHAMAD YAHYA

7.0 Conclusion

2009-06-12T02:33:00.000+08:00

Hi everyone!

Basically, we had introduce you generally about computer evidence. Later we had narrowed the scope about computer evidence in Malaysia. We also discussed briefly about cyber crimes. This is important so that you will understand about problems that occured in this cyber world, the situation and the importance of law to settle the problems. So that, we had cyber law!

In the next topic, we had give you several definitions of computer evidence from various sources and explained further about problems and solutions in computer evidence. We had highlighted how hard to prove crimes which were done by using computer and how computer evidence comes to help.

Computer evidence process is a topic which details the procedure on how to find, protect and use computer and it's materials as evidence in court.

Later, next chapter is the comparison about computer evidence and physical evidence. We had distinguish those two and then give opinion on which one better and strenght to be considered as evidence in court.

Then it comes to the most important topic, it talks about computer evidence in malaysia, the primary sources, weight of evidence, burden of prove, malaysian cases, and so on. Of course, we as Malaysian, should understand the situation and application of the law in our country!

Last but not least, we provide you selected articles about computer evidence and give our views and opinions about it. This is to enhance and develop your understanding about the current situation nowadays.

Final conclusion, we all hope, that, all of us will get benefits from our effort in creating this blog. Any comments, opinions and views are most welcome and thank you!

9.1 Glossary

2008-08-23T19:53:00.000+08:00

9.1 Glossary

If you have any difficulties in understanding specific term used in your computer or in the internet, here we provide you an easy way to use glossary of computer. By using this you may find terms you couldn't understand. Besides that, it give you definitions that are easy to digest. We are giving credit to iWEBTOOL, Saugus.Net and Whatis?com for providing us such great glossary relating to computer, technology, Internet resources and many others. Happy learning Guys!

Please click here