Slashdot Mirror
UK Cops Want "Breathalyzers" For PCs
An anonymous reader writes "One of the UK's top cyber cops, detective superintendent Charlie McMurdie, says the top brass want to develop the equivalent of a breathalyzer for computers, a simple tool that could be plugged into a machine during a raid and retrieve evidence of illegal activity. McMurdie said the device was needed because of a record number of PCs were being seized by police and because the majority of cops don't have the skills to forensically analyse a computer."
That's pretty much like building a mind-reader to figure out if a person has ever committed a crime. Good luck with that.
There is no -1 Disagree mod. Slashdot.org/faq defines mod options. USE IT.
This should be entertaining.
Good job managing to misread the summary.
Steganography, encryption, log erasing, etc. There is no 'out of the box' solution. Every computer is going to require a computer forensics team to go over it unless the OS manufacturer builds in those tools. And you can guarantee that NO manufacturer wants people to know that anyone can just open up your system via a backdoor at anytime.
This is my sig. There are many like it but this one is mine.
Because it's painfully clear your don't understand computer forensics either.
This space intentionally left blank
The next inevitable step for the UK gov't will be to outlaw using encryption on personal computers, because it's "too hard" to break.
This isn't a slippery slope for the UK anymore, it's a landslide, rushing down the mountain, annihilating everything in its way.
Sad.
Combine this with a remote access software, and you don't even need to enter a person's home to scan their PC for files anymore. Forget all this pesky due process for warrants and investigation, we can now scan tens of thousands of computers every day and just fish idly for perps. All done without even needing to look at your screen while the software does the dirty work for you.
What next, a breathalyser for paedophiles? Murderers? Terrorists? Why does not the UK police use that money to train their people or hire new specialists instead of trying to build a perpetuum mobile? Any criminal worth spending this project's money on is savvy enough to fully encrypt his hard disk. If they are so dumb not to encrypt compromising data, any cop with a few hours of training could find it. So what is this project really aiming at?
Victims of 9/11: <3000. Traffic in the US: >30,000/y
Seems to me this would bring up all problems about probable cause. Just because there is a computer doesn't necessarily mean it's been used for anything illegal, and can't be investigated because of that. It's kind of like, if the cops have a warrant to search for marijuana, and they find a gun, they can't take the gun in as evidence and run it and find that it's the murder weapon in something unrelated. Their warrant is for the marijuana, and just because they find a gun doesn't mean it's anything sinister.
The scary thing about this is that it doesn't matter if it works right, it just matters if it gets certified and approved for use as that what it claims it is. And that could just happen.
Power corrupts the few, while weakness corrupts the many.
I really think this is the same mentality that eventually comes to see individual rights and due process as pesky "inefficiencies" that only interfere with "real police work". They seriously need to tell new police recruits that their job is not easy and is not supposed to be easy. If any of them don't like that they should also be told where the exits are.
I think this is another example of relatively well-meaning people who fail to comprehend how dangerous their intentions are because they don't think them through. Let's say there is a device that can be plugged into a PC (maybe the USB port?) and almost instantly tell you whether it has illegal content with no need for expert analysis. Yeah I know that I should also posit the existence of the tooth fairy but bear with me. Who makes this device? How trustworthy are they? Do competitors or other rivals oddly happen to have a higher percentage of "illegal" PCs? Is the device a black box or can the average person examine and scrutinize it? If the cops already don't have the staff or the expertise to perform forensic analysis on PCs, what's our guarantee that they will correctly use this device or that they can offer any sort of assurance that the way it is used won't violate anyone's civil rights? What's to prevent criminals from obtaining one (by whatever means) and making sure that their illegal data isn't where this thing is looking? If I can think of this in a few minutes, WTF are these people smoking that they consider this a serious proposal? Or do they simply not care about these concerns?
You know what you'll probably never see? The police "top brass" asking for a device to help make sure that their officers don't violate anyone's civil rights and that they follow all the laws concerning due process.
It is a miracle that curiosity survives formal education. - Einstein
Usually, only the stupid ones get caught. Knowing to do what you have suggested, moves one out of the realm of stupid.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
When I read the headline, I thought they literally meant a breathalyzer, to keep drunk people off PCs. I could probably use one, it would cut down on the drunk IMs and facebook posts.
Her day job is architect of the UK's Police Central E-crime Unit, so it might be a bit late for that.
Having said that, I get the distinct impression from RTFA that this is pie-in-the-sky "this is the sort of tool we'd like in an ideal world, not that it's even remotely practical" rather than something that's in active development:
said frontline police ideally need a digital forensic tool as easy to use as the breathalyser, to help them deal with growing numbers of computers being seized during raids on suspects' homes
Yep, and I bet they'd like a machine which they can just turn on, punch in details of an unsolved crime and bingo! it tells you the perpetrators name, address, telephone number, the car they drive, their plans for the next 48 hours and where sufficient evidence to obtain a conviction can be found. It's fairly obvious from the article that whatever qualification this woman has, none of them involve technology.
As other posters have noted, cyber fraud is hard to prove, since the evidence it leaves behind (data, transactions, account numbers) looks so much like legal commerce. It takes a lot of smart work by educated professionals to prove the difference.
Now you know one of the reasons that the police like drug laws so much: The key facts can be understood and collected by an officer with an IQ of 80 and just a couple months of training.
"We reject as false the choice between our safety and our ideals." --The American President (20.1.2009)
What?
It's an apt post.
Spyware snoops around and grabs whatever it finds and deems to be unbecoming of a law abiding computer user.
They then hand that off (and the pc itself, likely) to a group of people who will do the analysis.
The post above you implies that this tool will not be of much actual help, and I agree. A "clean" report from the tool means nothing, and for any actual raids the computers will still be combed over by a forensic team. Any "dirty" report from the tool will result in the same outcome.
What this is really about is passing the buck and keeping face - the cops don't want to look incompetent, so they create this tool and publicize it.
Any failure of the cops will be blamed on the tool still being a work in progress, hackers actively working against the tool, etc.
Any responsibility on the part of the cops will be passed off immediately to the forensics teams. When the tool gives out a "dirty" report, the cops will fill out the green "Suspicion of Illegal Digital Bits on Electrical Personal Computing Device" form and hand over the report and the pc to the forensics team.
Once the tool is accepted as good and trustworthy, departments will find any excuse at all to use them to harass and extort money from the public.
Noise complaint?
Let's bang on the doors, give them shit, and check their computers for illegal activity. You just KNOW that music isn't paid for.
No, sir, since we heard music from the street, and we clearly can see you have a computer, and sound system, and a lack of physical CDs/tapes/records, in plain sight. We have reason to believe a crime has been committed. We don't need a warrant to perform a cursory search. If the search turns up anything, your equipment will be confiscated as evidence.
It's in the goddamn rfc, they HAVE to follow it. What are you, from Microsoft?
The first thing that occurs to me is that any appliance easy enough for a beat cop to use couldn't be very high-grade forensics. If there is a standard set of techniques used by the appliance, there will almost immediately (as soon as one is stolen) be a standard set of work-arounds. After which, only the profoundly stupid and/or set-up will ever be caught.
On the other hand, it occurs to me that the authorities only need the occasional high-profile arrest to keep funding going, so maybe it's a win-win for all -- the gov'ment gets credit for "cracking down on porn" and the hard cores have a known set of procedures to keep their stuff under cover.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Conducting a search due to a crime in progress or evidence in plain sight is significantly more difficult -- at least in the US -- than you make it out to be. Never mind that copyright infringement is, except in a few cases, a civil matter and not criminal (meaning the police cannot investigate it, and could not possibly claim there was open evidence of a crime).
The problem with the original post is that it called the desired tool spyware. Spyware has a particular meaning: it is software that is installed surreptitiously (or installed intentionally under the auspices of legitimate software) that actively monitors or alters the computer's actions and/or your interactions with it. What they want is actually a first-response forensic tool, where when they serve a warrant for the seizure of computers, they can run first run this tool to quickly scan for obvious evidence of interest, rather than simply conveying the seized computers to a forensic lab.
In other words, it's very much like a breathalyzer, whereas spyware is somewhat more akin to a network of cameras with automated behavioral monitoring software in a mall.
And you're ALL Number 6.
Do you have the courage that Number 6 had? Will you fight back against Number 2?
Are you just "A number" or are you Free Men & Women?
The choice is yours.
Guaranteed! This comment 100% Anthrax free!
The cops can and will search and bust you with a reasonable suspicion / in plain sight excuse SO easily. Yes, in the USA.
Do you really think that such a tool, if created, would not be spyware?
Spyware has no particular meaning. Malware, Adware, Spyware, Greyware, Foistware, Crapware, Bloatware, etc. have all been coined in a feeble attempt to classify and categorize programs. There is no official designation or definition.
The term is a merging of the word "spy" and the word "software". Literally, spyware is software that spies. What is spying? Spying is looking for and collecting information, often secretly.
Do you honestly believe that, if such a tool were created, the police would have you a report of what information was obtained, and what information was looked for?
Do you believe that there won't be cases where they use the tool on your computers and simply don't tell you?
Do you believe that such a tool, if implemented, would respect your rights and remove all traces of itself from your machine?
You jumped at the chance to shoot someone down and farm some karma by accusing them of not reading the summary.
In doing so, you missed the point of the post entirely (that people will still need to look at the data).
I called you out on it.
You got pedantic, saying the problem with the original post was the use of the term "spyware".
I'm calling you out again.
Let me get this straight. McMurdie is basically saying, We need a pervasive technology solution to compensate for the fact that I have the wrong and/or incompetent personnel.
Yea....
but have you considered the following argument: shut up.
A lot of "common sense" powers have had to be denied to police, because they've proven themselves incapable of not abusing them. Every counter-intuitive restriction placed on government officials can be traced to an incident of abuse so horrific, that society opted to "tie the hands" of everyone rather than entrust anyone with that power any longer. Really, it takes quite a lot for anyone in government to advocate a limit on governmental powers.
What you say is true, HOWEVER, the GPs post is on point.
On Law & Order, they call it the "Plain View Exception".
Apparently it exists IRL too: http://www.policelink.com/training/articles/2043-plain-view-doctrine-
Do daemons dream of electric sleep()?
The odds of an older IE install not having downloaded something illegal under British law are slimmer than the odds of a U.S banknote not having minute traces of cocaine. Theoretically possible, highly improbably, and great for the police to abuse.
Currently all analysis of computers must be done by computer forensic specialists, who are relatively expensive and limited in number.
There are tons of people out there that could do this work, the problem is that the computer crime labs are run by police bureaucracies that use the good ole boy system of advancement. Rather than hiring computer specialists and training them what little they would need to know about police work, they take police officers who have put in their time on highway patrol and spend huge amounts of money for computer forensics training.
Virtually any computer science grad could be trained to do computer forensics in *weeks*. The problem is that you will never recruit a computer science grad when you tell them that they will have to put two years in the highway patrol before they can even *think* about applying to transfer to the computer crime unit. And then there is the issue that the computer crime unit spends 90+% of its time investigating child porn, and quite frankly, who the *hell* wants to do that?
All this info is from the state where I live. I imagine its the same other places, but hopefully it's not, lol.
It's nothing like a breathalyser. A breathalyser detects one specific chemical compound in exhaled air and estimates the concentration of it in the blood.
What will this thing do, put up a progress bar with "Scanning for evidence of wrongdoing..."? It's just too generic and vaguer a target for it to work. Except on TV.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."