Well, that's the rub, isn't it? We're talking about non-law enforcement personnel who are going to be rewarded if they find something. And at that salary level, where people are frequently living month to month, it is indeed conceivable that somebody would place evidence just for the money.
$500 would be a crazy motivator, especially for the ex-military types who were drifting around after the service.
What, exactly, is that supposed to mean?
That being said the current business 'prayer' of soft skills, has been an utterly massive boon to military personnel of any rate.
Besides, a "smart" Geeksquad employee could just backdate the comptuer's clock or manipulate the file creation time directly to make it look like the image was placed there when the owner had the computer in his posession.
There are lots of advanced techniques to manipulate various aspects of Time related artifacts, but there are also lots of advanced techniques for determining whether a system has been tampered with. A skilled person might be able to erase evidence of exactly what they did, but often this creates artifacts or even an absence of artifacts that can be used to determine that someone tampered with the system in an attempt to cover his tracks.
I specialize in forensics in the context of incident response, so I don't typically run into anti-forensic techniques as sophisticated as law enforcement analysts may encounter. Perhaps there are ways to completely avoid detection. However, I imagine it would be difficult.
That actually sounds like an interesting idea. Would it be useful in any way and would it be be feasible in a way that couldn't be tampered with?
A proper encryption protocol consists of not only the encryption itself, but also authentication, verification and integrity checks. These are for protection against things like replay-attacks and indeed, tampering.
IIRC, booting a laptop with an encrypted FS, normally you'd enter your password, it'd apply a key-generating function (to turn the password into a proper 256bit AES key, or whatever's required), discard the password from memory and then use the key for operating a symmetric cipher (like AES) on the FS's read/write operations.
However, that doesn't quite work, it's not enough to do just that. An encrypted FS also needs authentication and verification, otherwise you open up yourself against all sorts of sneaky attacks stripping your encryption. So AFAIK, the system also keeps checksums and signatures with HMACs or something.
Admittedly, I don't know the exact details. One thing I'm not sure about is if there's the option of having some public/private key available for a bit of assymmetric encryption. Performance-wise you can't afford running that over the whole data stream (but who does that) because it's so much slower than symmetric encryption (which is why we have handshake protocols). But maybe do it once per block (or N blocks), adding cryptographic signatures to whatever's written. Blocks would be timestamped and these timestamps would be included in the signature too[0].
I could imagine, booting, without the password, would give you read-only access. Without password, the FS can only access the public key. The read operation uses this key to check the signatures on whatever blocks it's called to read. The write operation cannot be used to write any valid blocks, because it can't sign them without the private key (you can still trash blocks by overwriting them with invalid data, but you could do that anyways). Booting with a password allows the FS to decrypt the private key, allowing both read and write access.
Basically you'd have an encrypted FS, with the encryption left off but the verification left on.
For a Geeksquad-style attack you even get another layer of protection because without the password, the whole system is read-only. The "evil website put CP in my browser cache" attack is still possible because you'd be logged in, however in that case, at least you got verifiable timestamps on the written blocks, as well as your browser history, that can be analysed to show there was no intent to get, save or view this data.
I think this could be made to work in concept, in theory. Question is if you'd really want to use it though, authenticated verifiable timestamps on all your data, can also be a liability. Because people who "got nothing to hide" are just unaware that even they in fact, do. It means that for whatever you do on your computer, whoever can access the harddisk, can verify that whatever is on it was done by you, and only by you, as well as an undeniable proof of when it was done. That means zero privacy. Forward secrecy won't help here, because the whole point (verifiable authenticated timestamps) is about not having it. It may be nice for certain company laptops, however if it was my own machine, I'd prefer full-disk encryption, get the same protection and the privacy.
[0] while at it, why not also tag it with other metadata, such as origin (local or remote / where) and the process or application that issued the write command
If it's done in a competent way, the disk can be altered. Code can be installed on the hardware that will plant evidence after the victim returns home.
Worse: many filesystems don't note creation time but change time. I'd have to check what the status is for NTFS (the most likely consumer FS), but that's the case for virtually all Unix-and-similar filesystems: ext3/4, HFS, etc.
NTFS tracks creation time also, and it's available as one of the columns to sort by in Explorer.
A chain of custody with extremely rigorous procedures and protocols is the only reason a forensic expert has some level of trust.
Without that, and with incentive, this becomes nothing more than a farce.
[0] https://www.howtogeek.com/203154/how-to-change-created-or-mo...
[1] https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1
I'll still maintain it's not universally available on filesystems. And is unreliable (many allow changing this value, see, e.g., touch(1)). And that unallocated space lacks filesystem metadata.
The KGB encouraged Soviets to spy and report on one another for kickbacks. People would disappear to gulags over neighborly disputes and other petty things.
If you're going to reward people for hunting witches, expect a witch hunt.
His point was that we'd fly people who were at the wrong place at the wrong time to black sites on the basis of tips and hearsay from insurgents, Afghani and Iraqi people.
If you know know you can throw innocent people, your enemy or a scapegoat under the bus for kicks and profit with no repercussions, it's going to happen. It isn't a uniquely American or Soviet thing.
Really? You can bet on it. Around 33 soldiers or civilians for each captive human toy.
Since when?
Since bush created this shame and you are naively paying huge amounts of public money for it. After Miamigerald, only in 2015, the White House burned $445 million of the american citizens in this hole. Big sweet bussiness.
Source: http://www.miamiherald.com/news/nation-world/world/americas/...
Ironically Guantanamo is helping a lot of people to be much more successful as terrorists than when they were free. Each one of the prisoners is creating damages to USA economy for $7.29 million/year. Since 2011 and without throwing a single bomb.
For all of this, he won't even receive an apology, much less any compensation from the government. True "justice" in this case would be for him to be able to sue the FBI agent that mischaracterized the image as porn to get the arrest warrant (she later testified that it was not, which should kill the case right there), Best Buy for conducting illegal surveillance, and the government for wrongful prosecution. However, all of those cases are long shots. The most likely outcome is yet another example of the extreme injustices perpetrated by law enforcement agencies against innocent US citizens on a daily basis. The worst part is that the catalyst of most of these injustices is money - individual law enforcement agents wanting to advance their government careers or pad their resumes to get better paying jobs in the private sector. The whole thing is disgusting.
We as people just need to stop judging people based on assertion and innuendo. If someone is merely accused of something, and there's no evidence to back the charges, we need to judge (or refrain from judging) appropriately.
Similarly, if someone is not accused or convicted of a crime, despite having obviously committed (such as the police officers who murdered Kelley Thomas), we need to feel free to come to our own conclusions.
> We as people just need to stop judging people based on assertion and innuendo.
Yes, but.
Public arrest is a crucial freedom (secret arrests are a tool of totalitarian governments everywhere, including the British colonial government and, yes, Guantanamo too).
On the other hand the "perp walk" and other pretrial publicity/propaganda by governments seriously affect the accused's ability to get a fair trial, and should be stopped.
But since society won't change, the justice system needs to. Prosecutors could refuse to file charges in flimsy cases that are highly unlikely to result in convictions, such as the one at issue here. They could also choose not to lie or embellish facts to obtain search or arrest warrants that propel unjust cases forward. Unfortunately, both of these activities seem to be accelerating, not slowing down. We are seeing more and more "novel" prosecutions - those where criminal intent is questionable at best. Prosecutors do these things to pad their stats so that they can get a higher salary when they switch to private practice, but at a tremendous cost to both the defendants and the taxpayers.
Prosecutors could choose to do those things, but our reliance on their good graces is foolish and naive. There is no meaningful feedback for these people when they do wrong. On the contrary, they are often rewarded as you say with higher political office or in private practice. There is no meaningful oversight. This is true for every element of the judiciary, prosecutors, police, and judges alike.
I'm also saying: we need to take accusations from these people with a grain of salt. They're wrong a huge part of the time.
Yes. It's not a simple problem, but it literally means the justice system is failing to deliver justice to society. It's failing at its only function.
This usually motivates people to breed said species to collect the bounty.
The end results are rather similar.
https://en.m.wikipedia.org/wiki/Cobra_effect
Perverse incentives of rewarding information or activities.
The police on the other hand have less of an incentive to do so, unless they were specifically trying to hurt someone. They also have far less opportunity, as they would've already needed a reason to have said computer in their possession.
Motivation: Police structure and culture are set up so that catching more criminals gives kudos but not financial incentive. Other behaviors are valued higher, such as keeping calm in a situation, endurance, ability to negotiate intense situations. Crimes themselves are only a part of police work, much is peace-keeping, presence, simple observation and record-keeping. Television of course, focus on the most dramatic elements, but upon catching a pedophile, incentive isn't necessarily the highest perspective of importance. You still have to touch the creep, take their statements, deal with it emotionally, transport them all over the place in your vehicle.
Similar behavior: With the extremely rare exception of a few bad apples, very few police plant evidence at crimes. It has happened, just like hot air balloons sometimes fall out of the sky, but it's not a system which incentivizes and rewards the behavior.
Access: Police aren't at the keyboards of peoples' PCs, whereas Geek Squad people are given complete access to computers often in peoples' houses and in private. Moreover, they're typically working with an especially vulnerable population, those with little technical literacy. Fabricating that evidence remotely is a chore and supposing users employ half-decent passwords and ignore phishing, non-trivial. It requires special training and even equipment.
Similar Prosecution: Piracy and other forbidden data is more efficiently done by cutting things of at the source, typically by sophisticated actors who won't be in contact with The Geek Squad. It only rarely pays to go after individuals like this, or maybe there's more to the story than we understand from what the media tells us.
Police malfeasance is not extremely rare in the United States. What's rare is one getting caught, and even more rare suffering a meaningful consequence, and rarer still prosecution for crimes committed by police.
>a few bad apples,
You do know that you're misusing the quip, right? A bad apple spoils the bunch.
>very few police plant evidence at crimes.
On what basis do you make that statement? They plant evidence, they invent it from thin air (I smelled marijuana, alcohol, etc.) They misuse drug dogs. Some of them are very much "ends justify the means" types who will take shortcuts to convict people they "know" to be dirtbags.
>it's not a system which incentivizes and rewards the behavior.
You should study what motivates police officers. Fact is, such malfeasance is rewarded, a lot of other terrible behaviors are rewarded officially and unofficially. But the thing that's rewarded the least in policework? Admitting mistakes.
Few examples:
https://www.cnet.com/news/doj-we-can-force-you-to-decrypt-th... https://www.cnet.com/news/judge-americans-can-be-forced-to-d... https://www.techdirt.com/articles/20120124/17260917532/judge...
I think the highest risk of evidence being planted would occur during the search and seizure process, so encryption would help you there. And it also prevents informants from doing it and then selling you out for their own benefit. And it prevents thieves from looking through your files if your bag gets snatched.
Overall I think disk encryption provides some great benefits.
EDIT: although you have to be more careful about data loss, for example: https://www.gwern.net/Notes#november-2016-data-loss-postmort...
The thing is that you must have this as your standard practice... you can't just adopt it when the feds kick down your down.
https://www.digitalintelligence.com/products/forensic_duplic...
This is done for chain of custody reasons but would also effectively circumvent your security.
You need to have your storage medium self destruct if it is hooked up to a system other than the one it was paired with.
This system would have to rely on the logic board of the storage device so you would have to harden that so that a swap of the logic board also renders the storage device inoperable.
I mean physical destruction of the NAND gates... just kill it with a "hammer" kind of destroyed. Set it up so it's a fail-deadly switch, and there you go.
Obviously don't keep your family photos on it.
People do not swap the logic boards of drives often, because unless you get an exact revision match they will be incompatible.
Regarding Ramona Fricosu
"Fricosu's attorney claimed it was possible she did not remember the password. A month later, Fricosu's ex-husband handed the police a list of potential passwords.[3] One of the passwords worked, rendering the self-incrimination issue moot."
We have no way of knowing what would have happened ultimately.
How could we possibly know?
>Mark Rettenmaier, a gynecologic oncologist on staff at Hoag Hospital, had the pornography on three portable hard drives, a laptop and his iPhone, according to a federal grand jury indictment filed in November.
1. http://www.latimes.com/tn-dpt-me-1224-doctor-update-20141222...
Should law enforcement not be obligated to follow the law when they're hunting down people we don't like?
The search was authorized.
>The hard drive arrived at Best Buy’s Brooks, Kentucky facility on November 25, 2011, and an initial search was performed by a Best Buy employee at 9:00 p.m. on November 28, 2011, revealing that the “drive appears to have been restored, underlying data visible.” (Bates 853.) Best Buy called Rettenmaier less than thirty minutes later; he authorized “Level 2” repair and identified “[p]ictures, excel files, quicken files, text and word documents” as the most important files to recover. (Id.)
>On or about December 20, 2011, Best Buy technician John “Trey” Westphal observed what he deemed to be inappropriate content on the hard drive. (Dkt. 152 at 4.) His discovery occurred after the data recovery repair for images—“to determine that the repair was successful [Westphal] must access the files to verify that the files were recovered intact.” (Bates 823.)
The technician had a duty to notify authorities.
The technicians were classified as CHS so that the FBI could track their relationship with them.
>During 2007 and 2008, I am aware of four employees of Best Buy Geek Squad in Brooks, Kentucky, who contacted us regarding child pornography on customers' devices. To best track the relationship with these individuals and document contacts the FBI had with them, we classified these individuals as confidential human sources ("CHS's"), though they were simply employees at the Best Buy Geek Squad who happened to be in a position to report child pornography that technicians had come across on devices during the course of repair.
Further searches revealed child porn. Not the "grey-area" stuff that kicked off the investigation, if you can even call it that.
>A later search of the iPhone revealed alleged child pornography that is charged in Count 2 of the Indictment.