Court Rules Police Can Force Users to Unlock iPhones With Fingerprints, But Not Passcodes

This just in from MacRumors.com, "A Circuit Court judge in Virginia has ruled that fingerprints are not protected by the Fifth Amendment, a decision that has clear privacy implications for fingerprint-protected devices like newer iPhones and iPads.

According to Judge Steven C. Fucci, while a criminal defendant can't be compelled to hand over a passcode to police officers for the purpose of unlocking a cellular device, law enforcement officials can compel a defendant to give up a fingerprint.

The Fifth Amendment states that "no person shall be compelled in any criminal case to be a witness against himself," which protects memorized information like passwords and passcodes, but it does not extend to fingerprints in the eyes of the law, as speculated by Wired last year."

Keep reading the article by clicking here.

Strengthening Forensic Science in the US

The Organization of Scientific Area Committees (OSAC) began sending out letters to subject matter experts a few weeks ago. OSAC is part of an initiative by NIST and the Department of Justice to strengthen forensic science in the United States.

Of particular interest to the readers of this blog, the IT/Multimedia Scientific Area Committee (SAC) has named and published its committee Chairs. The IT/Multimedia SAC consists of the Speaker Recognition, Imaging Technologies, Digital Evidence, and Facial Identification subcommittees.

I've been telling you that this is coming since the NAS report was published a few years ago. Well. Here it is.

The next press release from the OSAC should contain the names of the subcommittee members as well as the dates/locations for the first SAC meetings.

Enjoy.

Amped FIVE Update: new tutorials, DVR formats, and more

Amped Software announced another update today. "First of all the IFrame seek added in the previous version has been improved to work on all filters (with the exception of Frame Selectors).

As usual, we had a lot of our users requesting the conversion of specific DVR formats. In this update we added 3 new DVR formats (PAR, MGV, DRV). PAR and DRV, were already supported but we added a new sub-type as many times files with the same extension actually come in many different flavors. Thanks a lot to everybody who is contributing to the development with requests!

We’ve also included the DVR Screen Capture tool to make it easier to grab the selection of the area.

A lot of our users don’t do actual casework on workstations connected to the Internet. For this reason we just added a message in the menu item Help > Check for Updates On Line which will give you the link where to check if your version is up to date from the browser on another PC.

Finally, we’ve added and updated tutorials to include screenshots from the latest version. Amped FIVE has come a long way since they were written!"

Enjoy.

LEEDIR in use in Pumpkin Riot Probe

This just in from the AP: "Police in New Hampshire are using a relatively new application to collect photos and videos they hope will lead to arrests following weekend chaos at a pumpkin festival.

More than 80 people were arrested after parties got out of hand Saturday in Keene, leading to property destruction and injuries. Police in riot gear used tear gas and pepper balls to control crowds as large as 2,000 people.

Keene police have created a LEEDIR account, or Large Emergency Event Digital Information Repository, where people can send images and videos directly from their smartphones to police.

More than 100 people have already sent files as the investigation by several police agencies continues.

LEEDIR is an online and mobile app that can be activated after a major emergency."

FIVE updated

The recent update to Amped Software's FIVE brings a welcome refresh of the Filters panel.

As you scroll down the filter group (left side), the individual filters move along with you - justified to assure that they're in view when you highlight a specific group.

I know, it's a little thing. But it's the little things that make life worth while.

Use the Check for Updates feature to make sure that you have the latest version. There's usually the inclusion of new file format support as a wee bonus.

Enjoy.

Codes of Ethics

Given Sunday's post about the many people out there claiming to be experts in Forensic Video Analysis, I began wondering if the courts could/should enforce a Code of Ethics.

I think many of the organizations out there for people that do what we do have some sort of statement about ethics or an actual Code of Ethics. The IACIS, for example, has theirs on their membership page.

IACIS Code of Ethics
IACIS members must demonstrate and maintain the highest standards of ethical conduct.

IACIS members must:

• Maintain the highest level of objectivity in all forensic examinations and accurately present the facts involved.
• Thoroughly examine and analyze the evidence in a case.
• Conduct examinations based upon established, validated principles.
• Render opinions having a basis that is demonstratively reasonable.
• Not withhold any findings, whether inculpatory or exculpatory, that would cause the facts of a case to be misrepresented or distorted.
• Never misrepresent credentials, education, training, and experience or membership status.

How incredibly refreshing.

But, can an examiner accurately present the facts involved if they don't understand the science behind the tools and techniques that they employ? Can an examiner thoroughly examine and analyze the evidence if they don't have the appropriate tools - or those tools are out of date? Can "it just doesn't look right to me" be an established and valid principle? Is demonstratively reasonable too much to ask? Does your inclusion on the Superior Court's list of experts sufficient proof of your training, experience, and education?

To pull something like this off at the Superior Court level, it would take a court panel and judge that invests a bit of time to see what's out there in terms of gear, what the science says, who's doing what, and etc. 

I understand that the Courts are massively overworked. But, if you put a list out there, it should mean something. Sadly, the video/image section of LA County's list needs a bit of trimming.

Turning a filter on or off in Amped FIVE

At a recent training session, the topic of what to do with filters if you've used them but don't want to have them influence what's being displayed - but you still want them on your report.

Obviously, you can throw filters away. But, in doing so, the filter's settings won't appear on the report.

In the Filter Settings box (top right) you'll see a small check box. This is the On/Off button. Check in the box, the filter's on and the settings are reflected in the workflow. No check in the box, and the settings are not reflected.

Where this comes in handy is when you're using an edge detection filter, like Sobel, and you don't want your image/video looking like a modern art masterpiece. Once you've found your edges and performed task that required knowing the location of the edges (like Measure 1D, etc), turn the filter off. In this way, your filter use is reflected in the report.

Think of this like turning on/off layers in Photoshop.

Many thanks to John U. from the SLC PD for taking the initiative to install and try the program ahead of the training, and for actually reading the support documentation and watching the training videos. Also, thanks to John for making my time at SLC run smooth. It's always nice to hit the ground running.

BTW, if you're interested in bringing a training session to your agency, just send a note. 2015 is going to a busy training year, but there's still some openings in my calendar.

New Partnership Provides Law Enforcement With Digital Evidence Solution

Homeland Security Today recently featured a story on the partnership between MediaSolv and Amped Software. Whilst it's true that no single vendor provides an end to end solution for our digital evidence needs, this new partnership gets really close. When you factor MediaSolv's work with Cellebrite into the equation, MediaSolv looks even better. Check out the article here.

Forensic Focus asks Amped Software, can you get that license plate?

This just in from Forensic Focus: "We find ourselves analyzing new surveillance videos almost every day, and in most cases we can either solve the problem very quickly or understand (even quicker) that there is no information to recover in the video. In special cases though, where something very specific and strange happened, or the problem is very complex, it can take a lot of time.

As always… Pareto principle: you solve 80% of the cases in 20% of the time, and, well, 20% of the cases takes 80% of the time. In our own work, the right numbers are probably 95% to 5%, but the idea still holds.

With our experience in working on several thousand cases, we can estimate whether an image or video contains some information and is worth processing, or not, very quickly. In this article, we will describe some of the tests that can be done to quickly tell if you can get that license plate!"

Continue reading the article over on Forensic Focus.

New SWGDE Draft Posted for Public Comment

This just in ...

The Scientific Working Group on Digital Evidence (SWGDE) is pleased to announce the posting of a new draft document for public review and comment: "SWGDE Best Practices for Handling Damaged Mobile Devices" at https://www.swgde.org/


In accordance with SWGDE policy, draft documents will be posted for a minimum of 60 days for public comment. The first page of each draft document gives instructions on how to submit feedback to our Secretary via an email to secretary@swgde.org mailto:secretary@swgde.org All feedback received prior to our next meeting in January 2015 will be reviewed by the appropriate subcommittee at that meeting.


At the conclusion of our last meeting, SWGDE voted to release the following documents as Approved versions after considering and incorporating feedback received during the public comment period. However, as noted on the cover page of each document, "SWGDE encourages stakeholder participation in the preparation of documents. Suggestions for modifications are welcome and must be forwarded to the Secretary in writing at secretary@swgde.org"

Digital and Multimedia Evidence (Digital Forensics) as a Forensic Science Discipline v2
SWGDE Best Practices for Computer Forensics v3.1 SWGDE Best Practices for Handling Damaged Hard Drives v1 SWGDE Capture of Live Systems v2 SWGDE Focused Collection and Examination of Digital Evidence v1 SWGDE Mac OS X Tech Notes v1.1 SWGDE Recommended Guidelines for Validation Testing v2 SWGDE Best Practices for Forensic Audio v2 These recently approved documents are available for download on the Current Documents page of the SWGDE website: https://www.swgde.org/ documents/Current%20Documents

We appreciate your participation as SWGDE continues its mission to bring together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation as well as ensuring quality and consistency within the forensic community. Anyone interested in receiving regular updates via email is encouraged to sign up for the SWGDE NewsBytes newsletter here: https://www.swgde.org/ newsletter/newsletterSignUp

Thank you,

David Hallimore
SWGDE Outreach Committee Chair
SWGDE https://www.swgde.org/

Are law enforcement agencies tone deaf?

Over at the Washington Post, there's been a series of articles quoting various current and former law enforcement officials and politicians predicting doom, gloom, and madness if Apple and Google go through with their plans to include encryption into their next generation of operating systems. In the latest article, the outgoing US Attorney General essentially asks companies to do it for the children. "Attorney General Eric H. Holder Jr. said on Tuesday that new forms of encryption capable of locking law enforcement officials out of popular electronic devices imperil investigations of kidnappers and sexual predators, putting children at increased risk."

The do it for the children card has been so over-used that folks are tired of hearing of it. Here's why regular folks want encryption:

• It has been documented that law enforcement agencies in the US have downloaded the contents of mobile phones or otherwise searched the phones during routine traffic stops. 1 2 3 4 5 6 7 8 9
• What is the retention policy of the data police acquire at a routine traffic stop? If you aren't charged with an offense, if no ticket is issued, what happens to the data? How long do they keep it? Do they merge the data into a massive government database? 1 2 3  Ask your local PD. Call a few times. See how different each response is.
• How secure is your personal data once it's in the hands of law enforcement? 1 2 3

Again, ordinary folks are concerned about their privacy and the protection of their personal information. The fact that the DOJ and other agencies don't understand this, or don't care, further worries the average person. 

In the US, the person is sovereign and free. Our Constitution places limits on what our government can do to us. The people have the power and our Constitution binds the government, limiting it to only those authorized activities.We're innocent until proven guilty. Not providing your mobile phone to law enforcement during a routine traffic stop is not proof of guilt, or even cause of reasonable suspicion. When the agents of the government make big moves outside of their Constitutionally limited areas, folks are going to seek a way to protect themselves. It's simple, actually.

Before pulling the do it for the children card, LE agencies should have solid policies governing when/how data collection can take place, what's going to happen to the data, and how the data will be protected - as well as a way for a citizen to appeal to have their data removed from the system without expense. 

But right now, folks just aren't buying what the DOJ is selling. They will, however, be buying what Apple and Google is selling.

GM's new high-tech recorder is illegal in many states

Earlier this year, I reported that GM had added a DVR to its venerable Corvette. It seems that GM was a little shy about the details of their system in the initial marketing of the system. Now, RT.com is reporting that GM is warning owners of the car in several states that they might be committing a felony by activating the system. The problem: it also records audio.

“Federal wiretapping laws generally require only one party to consent to a recording of an interaction," Ars Technica reported. “But in California, Connecticut, Delaware, Florida, Hawaii, Illinois, Louisiana, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington, all parties involved in the recording must either consent to a recording or at least be aware that the recording is happening, depending on the state. So if a Corvette owner turns on Valet Mode in California and turns the car over to the unknowing attendant, that Corvette owner could be committing a felony.”

“If they do use the Valet Mode, they should (i) notify any occupants of the vehicle that they will be recorded while in the vehicle, and (ii) obtain their consent to this recording. It is very important that you explain this to each customer at the time of delivery.”

GM is “evaluating several scenarios for the software update – for example disabling the audio recording in Valet Mode, but keeping the video recording active,” Monte Doran, a spokesperson for Corvette, said to Forbes.

Ryan Calo of the University of Washington School of Law explained that the audio – not video – recording is the legal sticking point of the technology.

“It’s really the interior audio that triggers various wiretap laws,” Calo said. “But not if the owner warns, thereby defeating the expectation of privacy.”

OOPS!

Project NOLA - a public private CCTV partnership

You've heard that the NYPD has blanketed areas of NYC with CCTV cameras. Ditto for Chicago and a few other metropolitan areas. These efforts have been funded and run by the local police agencies. But, in an interesting twist, ProjectNOLA has the public buying and installing their own CCTV systems, then turning over control to the New Orleans PD - and paying the NOPD for the privilege.

"Part of a sprawling surveillance strategy dubbed “Project NOLA,” citizens’ security cameras would be integrated with footage shot from other law enforcement cameras already installed around the St. Bernard Parish area near New Orleans, and would give the sheriff’s department the ability to tap into those cameras at a moment’s notice.

“All you have to do is, you can go to a map and click on an icon for that camera in that area and pull up that camera and it’ll give us a live feed from that area,” St. Bernard Sheriff Jimm Pohlmann told CBS affiliate WAFB, adding that access to cameras on private property would eliminate the need for police to visit homes in person. “I think the more cameras out there, the more successful the program will be.”

"A $10 monthly fee is required for residents interested in granting police access to their existing home camera systems, but those who don’t yet have cameras can purchase entire kits from [ProjectNOLA's founder] for $295. For another $150, you can also get those cameras professionally installed.

“This is great for NOPD,” writes Jules Bentley for AntiGravity Magazine, “firstly because [the Police won't] have to pay for any of this—the costs are borne by the home or business owner and the increasingly grant-funded Project NOLA nonprofit—and secondly because private cameras can do things the government’s not allowed to.”

There's no indication that the ProjectNOLA system is actively monitored by LE officials. Rather, it seems that the residents are expected to report the crimes as usual with the police having the access to retrieve the CCTV footage remotely. The technical/procedural details about the system are rather thin at this point. Still and all, it's an interesting development.

FBI blasts Apple, Google for locking police out of phones

The war of words has ramped up over Apple's / Google's plans to encrypt handsets. Law Enforcement spokespersons are taking to the media to voice their frustration over the decision.

"FBI Director James B. Comey sharply criticized Apple and Google on Thursday for developing forms of smartphone encryption so secure that law enforcement officials cannot easily gain access to information stored on the devices — even when they have valid search warrants.

His comments were the most forceful yet from a top government official but echo a chorus of denunciation from law enforcement officials nationwide. Police have said that the ability to search photos, messages and Web histories on smartphones is essential to solving a range of serious crimes, including murder, child pornography and attempted terrorist attacks.

“There will come a day when it will matter a great deal to the lives of people . . . that we will be able to gain access” to such devices, Comey told reporters in a briefing. “I want to have that conversation [with companies responsible] before that day comes.”

"Los Angeles police Detective Brian Collins, who does forensics analysis for anti-gang and narcotics investigations, says he works on about 30 smartphones a month. And while he still can successfully crack into most of them, the percentage has been gradually shrinking — a trend he fears will only accelerate.

“I’ve been an investigator for almost 27 years,” Collins said, “It’s concerning that we’re beginning to go backwards with this technology.”

The new encryption initiatives by Apple and Google come after June’s Supreme Court ruling requiring police, in most circumstances, to get a search warrant before gathering data from a cellphone. The magistrate courts that typically issue search warrants, meanwhile, are more carefully scrutinizing requests amid the heightened privacy concerns that followed the NSA disclosures that began last year.

Civil liberties activists call this shift a necessary correction to the deterioration of personal privacy in the digital era — and especially since Apple’s introduction of the iPhone in 2007 inaugurated an era in which smartphones became remarkably intimate companions of people everywhere."

Read the whole story by clicking here.

VisionBase's Previs vs. Ocean Systems' Field Kit

Not to be outdone by Ocean Systems, long time vendor VisionBase (UK) recently announced the release of their Portable Recording of Evidence, Viewing and Investigation System (Previs). The best comparison of the two companies' products would be if Ocean Systems' Field Kit was based on their Hurricane Mobile Video Editing system.

VisionBase loses me with this claim on the product's data sheet, "DVR’s exporting via USB instead of CD/DVD present the risk of transferring viruses or malware. DVR hardware in most instances are capable of recording and displaying a much clearer and sharper image when viewed via video, VGA and HDMI, PREVIS takes advantage of this fact allowing recording of the audio and video in original high-resolution at up to full HD 1920x1080 pixels." It's like a firearms examiner saying that a picture of a gun is better than the actual gun for forensic examination cause their hands might get dirty. Seriously? I'd rather have the data, the actual evidence, than a picture of that evidence - as I've said many times on this blog.

Then there's this:

Create Evidence in uniform format? Are you kidding!? Create evidence!? Come on folks.

From the looks of it, Previs allows for the user to load all of VisionBase's software and perform clarifications and case management in the field. The laptop version of Previs breaks the capture device out as a separate piece of hardware, like the Field Kit. Both companies have bags of cables and connectors that ship with the units. VisionBase adds a handy trolly - your tip that the full version of Previs might be quite heavy.

No hint at pricing. But, as they're a UK based company, they probably can't compete too closely with the field kit on price. Also a factor for US agencies is the ability to buy and get service from a US vendor. When last I dealt with VisionBase US, there were just a few employees in Florida ... and no technicians outside of the UK. Perhaps that's changed. Nevertheless, its something to consider.

Experimental Feature Manager in Photoshop CC

Photoshop's new Experimental Feature Manager now has experimental (beta) features that you can enable and try out. As these features are in beta, you might want to refrain from using them for case work. For example, many folks are now using tablet PCs with touch screen support. To enable the experimental features, do the following:

Select Preferences>Experimental Features.

Select the experimental feature that you want to enable.

Click OK.

Restart Photoshop.

Enjoy.

Video Evidence May Increase Our Biases, Especially When We Look Too Closely

This just in from MedicalDaily.com, "You’ve grown up on a steady diet of TV and movies. Whether you’ve watched very little or excessively, you were born in a media saavy era so most likely you are wise in the ways that a videotape can be manipulated, and probably, too, you have some understanding of how any recorded scene affects you. Now, a new study points to possible gaps in our knowledge about how we watch videotape and how the attention we pay to it influences our decisions. When watching recorded evidence from a court case, a new study finds, people focus on the defendant for different amounts of time, and this influences them — increasing their biases — when it comes time to deciding on punishment. Even when we see evidence "with our own eyes," then, we may not be able to be objective.

How We Observe Makes A Difference
Are you aware of how much you focus on some details and not others while watching a movie or TV? The following series of experiments conducted by a team of researchers from New York University and Yale University suggest there may be wide differences in how we watch media. To understand the impact of videotaped evidence, the team began by gauging how much 152 participants identified with police officers by presenting a series of statements (e.g., “Your background is similar to that of most police officers”), which the participants then rated on a seven-point scale of agreement/disagreement.

Next, participants watched a 45-second video clip, minus the sound, depicting an actual though amibiguous altercation between a police officer and a civilian. On the tape, the officer attempts to handcuff a resisting civilian; after struggling, the officer pushes the civilian against his cruiser; the civilian bites the officer’s arm; then, the officer hits the back of the civilian’s head. Meanwhile, as participants watched the video, the researchers used eye-tracking technology to gauge how much of the time participants' gaze fixated on the officer. Afterward, participants learned facts that incriminated the police officer, and then they imagined themselves as jurors and answered how likely they would be to punish and fine him.

What did the researchers discover? How much each participant identified with police in general influenced how little or much they punished the particular officer only if they had focused their attention on him while watching the videotape. For instance, participants who looked frequently at the police officer punished him far more severely if they did not identify with him. By contrast, those participants who did not identify with him yet looked at him less often while watching the tape were less severe when punishing him."

Click here to continue reading this interesting story.

Encryption as evidence of obstruction of justice?

This just in from Wired.com: "Silicon Valley’s smartphone snitching has come to an end. Apple and Google have promised that the latest versions of their mobile operating systems make it impossible for them to unlock encrypted phones, even when compelled to do so by the government. But if the Department of Justice can’t demand that its corporate friends unlock your phone, it may have another option: Politely asking that you unlock it yourself, and letting you rot in a cell until you do.

In many cases, the American judicial system doesn’t view an encrypted phone as an insurmountable privacy protection for those accused of a crime. Instead, it’s seen as an obstruction of the evidence-gathering process, and a stubborn defendant or witness can be held in contempt of court and jailed for failing to unlock a phone to provide that evidence. With Apple and Google no longer giving law enforcement access to customers’ devices, those standoffs may now become far more common ..."

This will get messy. Using the 5th Amendment has had mixed results. My guess is that this will eventually end up at the supreme court. In the mean time, Apple and Google get a bit of free advertising.

Digital forensics method validation: draft guidance

The UK Government Forensic Science Regulator has released a new draft document for comment. The document, Digital forensics method validation: draft guidance, is a rather interesting read. Comments should be sent on the feedback form provided to FSRConsultation1@homeoffice.gsi.gov.uk and should be submitted by 31 October 2014.

It's more concerned with areas known in the US as computer forensics, but it does have a section for audio analysis and speech recognition. It does not concern itself with DME analysis or authentication.

Enjoy.

Apple will no longer unlock most iPhones, iPads for police, even with search warrants

This just in from the Washington Post, "Apple said Wednesday night that it is making it impossible for the company to turn over data from most iPhones or iPads to police — even when they have a search warrant — taking a hard new line as tech companies attempt to blunt allegations that they have too readily participated in government efforts to collect user information.

The move, announced with the publication of a new privacy policy tied to the release of Apple’s latest mobile operating system, iOS 8, amounts to an engineering solution to a legal quandary: Rather than comply with binding court orders, Apple has reworked its latest encryption in a way that prevents the company — or anyone but the device’s owner — from gaining access to the vast troves of user data typically stored on smartphones or tablet computers.

The key is the encryption that Apple mobile devices automatically put in place when a user selects a passcode, making it difficult for anyone who lacks that passcode to access the information within, including photos, e-mails and recordings. Apple once maintained the ability to unlock some content on devices for legally binding police requests but will no longer do so for iOS 8, it said in the new privacy policy.

“Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data,” Apple said on its Web site. “So it’s not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8.”

As the new operating system becomes widely deployed over the next several weeks, the number of iPhones and iPads that Apple is capable of breaking into for police will steadily dwindle to the point where only devices several years old — and incapable of running iOS 8 — can be unlocked by Apple.

Apple will still have the ability — and the legal responsibility — to turn over user data stored elsewhere, such as in its iCloud service, which typically includes backups of photos, videos, e-mail communications, music collections and more. Users who want to prevent all forms of police access to their information will have to adjust settings in a way that blocks data from flowing to iCloud.

Apple’s new privacy policy comes less than five months after the Supreme Court ruled that police in most circumstances need a search warrant to collect information stored on phones. Apple’s action makes that distinction largely moot by depriving itself of the power to comply with search warrants for the contents of many of the phones it sells.

The move is the latest in a series in which Apple has sought to distinguish itself from competitors through more rigorous security, especially in the aftermath of revelations about government spying made by former National Security Agency contractor Edward Snowden last year.

Although the company’s security took a publicity hit with the leak of intimate photos of celebrities from their Apple accounts in recent weeks, the move to block police access to the latest iPhones and iPads will thrill privacy activists and frustrate law enforcement officials, who have come to rely on the extensive evidence often found on personal electronic devices.

“This is a great move,” said Christopher Soghoian, principal technologist for the American Civil Liberties Union. “Particularly after the Snowden disclosures, Apple seems to understand that consumers want companies to put their privacy first. However, I suspect there are going to be a lot of unhappy law enforcement officials.”

Continue reading the story by clicking here.