A Linux-Based "Breath Test" For Porn On PCs

Gwaihir the Windlord writes "A university in Western Australia has started beta testing a tool that's described as 'a random breath test' to scan computers for illicit images. According to this article it's a clean bootable Linux environment. Since it doesn't write to the hard drive, the evidence is acceptable in court, at least in Australia. They're also working on versions to search for financial documents in fraud squad cases, or to search for terrorist keywords. Other than skimming off the dumb ones, does anyone really expect this to make a difference?" The article offers no details on what means the software uses to identify suspicious files.

Comments

Randoms searches, Yay.

[denis-The-menace]

Now everybody in Australia is guilty until proven innocent!

forensics

[Lord Ender]

Computer forensics is hard, expensive, and time-consuming. I would guess this is just a tool for cops to save cash in criminal investigations compared to hiring an expert, or at least to triage which systems need to be investigated by an expert.

Also, if your friends are IT staff and your online watercooler is slashdot.org, you may think everyone but the "dumb ones" knows how to encrypt a drive. But the reality is that the vast majority of criminals have never heard of Truecrypt.

Re:forensics

[Jabbrwokk]

I think you are correct. Most criminals are dumb. And I think you're right about this being a cash-saving tool. From the article:

The design concept is that any police person with adequate training could use the tool, so that when they go into a crime scene they can quickly review a computer for illicit images or videos.

Sounds like it relies more on officers' eyeballs than algorithms to do a quick scan for anything obvious. This tool will help them quickly move through the easy stuff, and allow them to focus time and resources on the more sophisticated criminals.

Re:Australia seems to be a pretty repressed countr

[Spatial]

Might want to avoid the US and the UK as well.

Re:Can't be challenged forensically?

[faloi]

IANAL, but the summary (at least) gives no indication that the forensic tool is going to be the last word. It's a bootable distro, so presumably the system has already been confiscated by whatever organization cares most about the potential crime. The forensic examiner(s) responsible for looking for data with the evil bit set boot to this CD and see if it flags anything. Then they examine anything that's flagged, and prep it for court.

Doing a thorough exam of an average drive can be time consuming, even if the user is kind enough to leave all their documents handily in the "My Documents" folder. Trying to examine several machines in a timely fashion would benefit greatly from a tool like this. If the disk flags something, and it's really illegitimate, the data just needs to get cataloged. Think of it as helping go for "low hanging fruit" that can be used to convict someone, without being as resource intensive as a full manual scan. I'm guessing that if the disk doesn't turn up anything, there will still be a long manual process involved to see if there's something there.

Illicit?

[reidconti]

Last time I checked, porn was not illegal.

Re:Illicit?

[gstoddart]

Since when was porn illegal? If some nosy cunt wanted to "breath test" my pc for porn, i'd just hold up a nice gynacological centrefold and say "look! i think i can see her kidneys! Now fuck off!"

Ah, but once crossing a border requires you to be scanned for any infractions, you won't have a choice.

Soon, it will be considered perfectly normal to subject yourself to full scrutiny in order to prove that you don't have anything they deem unacceptable.

Me, I find it appalling, as we throw away most forms of civil liberties in Western countries on the presumption that someone might have done something wrong, so we inspect everyone.

Cheers

Re:A "random breath test" for computers?

[gstoddart]

Oh great, expect that in a few years they will be running this on international travellers as a standard part of customs.

Sadly, this seems to be a part of a trend. Part of travel now means that you need to be subjected to complete search and inspection to make sure you haven't done anything wrong.

This includes fingerprinting, gathering of biometrics, and having all of your personal stuff exhaustively searched to ensure you have no porn, terrorist material, copyrighted material you can't prove you bought, or anything critical of the government of the country you're entering.

If you have probable cause that I'm smuggling something, maybe. But, in the case you point out where we scan everyone so they can prove themselves innocent ... well, modern society is pretty much hosed in that case. However, that seems to be where we're going lately.

Cheers

Re:About the only way I it COULD work...

[jaseuk]

The whole point of a hashing algorithm like MD5 is that even a single bit change should change lots of random bits in the resulting hash. If it was predictable it wouldn't be suitable for it's purpose.

Jason