Microsoft device helps police pluck evidence from cyberscene of crime

[InfoSec News <alerts () infosecnews org>]

http://seattletimes.nwsource.com/html/microsoft/2004379751_msftlaw29.html

By Benjamin J. Romano
Seattle Times technology reporter
April 29, 2008

Microsoft has developed a small plug-in device that investigators can 
use to quickly extract forensic data from computers that may have been 
used in crimes.

The COFEE, which stands for Computer Online Forensic Evidence Extractor, 
is a USB "thumb drive" that was quietly distributed to a handful of 
law-enforcement agencies last June. Microsoft General Counsel Brad Smith 
described its use to the 350 law-enforcement experts attending a company 
conference Monday.

The device contains 150 commands that can dramatically cut the time it 
takes to gather digital evidence, which is becoming more important in 
real-world crime, as well as cybercrime. It can decrypt passwords and 
analyze a computer's Internet activity, as well as data stored in the 
computer.

It also eliminates the need to seize a computer itself, which typically 
involves disconnecting from a network, turning off the power and 
potentially losing data. Instead, the investigator can scan for evidence 
on site.

More than 2,000 officers in 15 countries, including Poland, the 
Philippines, Germany, New Zealand and the United States, are using the 
device, which Microsoft provides free.

"These are things that we invest substantial resources in, but not from 
the perspective of selling to make money," Smith said in an interview. 
"We're doing this to help ensure that the Internet stays safe."

Law-enforcement officials from agencies in 35 countries are in Redmond 
this week to talk about how technology can help fight crime. Microsoft 
held a similar event in 2006. Discussions there led to the creation of 
COFEE.

Smith compared the Internet of today to London and other Industrial 
Revolution cities in the early 1800s. As people flocked from small 
communities where everyone knew each other, an anonymity emerged in the 
cities and a rise in crime followed.

The social aspects of Web 2.0 are like "new digital cities," Smith said. 
Publishers, interested in creating huge audiences to sell advertising, 
let people participate anonymously.

That's allowing "criminals to infiltrate the community, become part of 
the conversation and persuade people to part with personal information," 
Smith said.

Children are particularly at risk to anonymous predators or those with 
false identities. "Criminals seek to win a child's confidence in 
cyberspace and meet in real space," Smith cautioned.

Expertise and technology like COFEE are needed to investigate 
cybercrime, and, increasingly, real-world crimes.

"So many of our crimes today, just as our lives, involve the Internet 
and other digital evidence," said Lisa Johnson, who heads the Special 
Assault Unit in the King County Prosecuting Attorney's Office.

A suspect's online activities can corroborate a crime or dispel an 
alibi, she said.

The 35 individual law-enforcement agencies in King County, for example, 
don't have the resources to investigate the explosion of digital 
evidence they seize, said Johnson, who attended the conference.

"They might even choose not to seize it because they don't know what to 
do with it," she said. "... We've kind of equated it to asking specific 
law-enforcement agencies to do their own DNA analysis. You can't 
possibly do that."

Johnson said the prosecutor's office, the Washington Attorney General's 
Office and Microsoft are working on a proposal to the Legislature to 
fund computer forensic crime labs.

Microsoft also got credit for other public-private partnerships around 
law enforcement.

Jean-Michel Louboutin, Interpol's executive director of police services, 
said only 10 of 50 African countries have dedicated cybercrime 
investigative units.

"The digital divide is no exaggeration," he told the conference. "Even 
in countries with dedicated cybercrime units, expertise is often too 
scarce."

He credited Microsoft for helping Interpol develop training materials 
and international databases used to prevent child abuse.

Smith acknowledged Microsoft's efforts are not purely altruistic. It 
benefits from selling collaboration software and other technology to 
law-enforcement agencies, just like everybody else, he said.


_______________________________________________      
Subscribe to the InfoSec News RSS Feed
http://www.infosecnews.org/isn.rss