Download - Foreign Military Studies Office - U.S. Army

servers, immediate disaster recovery steps are taken to get the system back
online. This may or may not affect the subsequent investigation into what
happened, who did it, and why. If the decision is made by management to bring
in law enforcement, it will be necessary to present the data collected so far and
to conduct interviews of all involved. Another parallel process should involve
an ongoing damage assessment to include what it will cost the company to
repair the damage and to support the investigation. Law enforcement officials
will take similar steps. They will gather data via a forensic process to protect
data of informational or evidentiary value and document the steps.
Legal Processes in a Cybercrime Investigation
Cybercrime investigations involve several legal steps and processes
that must be accomplished in order to expand the search. Some of the elements
that assist law enforcement authorities are explained below:
• Consensual Searches – The first questions to answer are who
conducts the search and what is to be looked at. Initial investigative
steps for an intrusion are to collect data about who, what, when,
where, why, and how an intrusion occurred. The data collection
begins when a complaint is received. Immediate attention must be
given to data that is volatile and can readily be deleted or changed.
In most instances, the company with a complaint may have already
backed up the data and taken action to return the system to
operational status. Law enforcement realizes that a company cannot
usually afford to have a system tied up as evidence for long periods
of time. Getting all the pertinent information about the system, the
network, the access controls, the hardware and software
configuration of the affected system, the protection measures of the
network, and information from any other system that could
potentially hold data of value is extremely important to the
investigation. A parallel track for law enforcement is to preserve
the account transaction records that the network provider or the ISP
may have.
• Use of Banners – Banners at the entry or initial connection to a
computer are much like the sign at the gate of a military
installation. Those signs basically say that if you enter, you are
giving consent to search. These banners have been reviewed by
many legal experts and can give a company much leeway in what
they decide to monitor regarding the usage of the company’s
network or computers.
328