Download - Foreign Military Studies Office - U.S. Army

e stored and/or through which data objects are transferred.
• Original Digital Evidence – Physical items and data objects
associated with such items at the time of acquisition or seizure.
• Duplicate Digital Evidence – An accurate digital reproduction of
all data objects contained on an original physical item.
• Acquisition of Digital Evidence – A process that begins when
information and/or physical items are collected or stored for
examination purposes. The term “evidence” implies that the courts
recognize the collector of evidence. The process of collecting is
also assumed to be a legal process and appropriate for rules of
evidence in that locality. A data object or physical item only
becomes evidence when so deemed by a law enforcement official
or designee.
• Copy – An accurate reproduction of information contained on an
original physical item, independent of the original physical item.
Collecting and Exchanging Digital Evidence
Due to the very nature of the global economy and the accessibility of
governmental, industrial, academic, and other information to hundreds of
millions of people across the globe, it is necessary for law enforcement to
collect and exchange digital evidence across jurisdictional and national
boundaries. The US and international organizations seeking to assist the law
enforcement effort provide the following resources.
National (US)
1. National Infrastructure Protection Center (NIPC) – The center
is a joint government and private sector partnership whose mission
is to prevent and respond to cyber attacks against US critical
infrastructure systems. NIPC has become the US cybercrime point
of contact for international inquiries into cyber intrusion issues.
http://www.nipc.gov/
2. US Department of Justice (USDOJ) Computer Crime and
Intellectual Property Section (CCIPS) – This is a section of the
Criminal Division of the US Department of Justice. It drafts and
recommends US laws for cybercrime issues; develops guidelines
for US Attorneys and law enforcement in the handling of digital
evidence and presentation of cases involving cybercrime in federal
courts of law; assists local and state governments in the formulation
of local and state laws involving cybercrime and digital evidence
issues; represents the US on international organizations working on
international cybercrime issues; and participates in a myriad of
other tasks that promote legal issues addressing cybercrime and
313