Challenges and Opportunities for Statistics in Digital Forensics

Transcription

1 Challenges and Opportunities for Statistics in Digital Forensics Turing Gateway to Mathematics Isaac Newton Institute 1 st December 2016 Dr. James Luck (james.luck@met.police.uk) TOTAL POLICING Date Arial 14pt

2 Overview Brief overview of Digital Forensics in the MPS The requirement to define Uncertainty Digital Forensic areas where we do define Uncertainty Areas where we could define Uncertainty, but don t Areas where we don t define Uncertainty Possible relief through the ValiD Project TOTAL POLICING

3 Digital Forensics in the MPS TOTAL POLICING

4 96 Technical Staff in Central Laboratory + 61 in Hubs Supporting Front-Line Policing Audio Video AV Cell Site Analysis CSP/ISP Data Analysis CELL SITE & COMMS DATA A/V Enhancements Authentication Data Recovery PRNU / ENF / Face Comp. Phones Computers Network Data Recovery Complex Data Recovery MOBILE DEVICES Data Analysis Interpretation CASEWORK DEVELOPMENT Strategic R & D Academic Engagement Industry Liaison Unusual Casework TOTAL POLICING

5 The Scale of MPS Digital Forensics Estimate 49,036 Exhibits for FY 2016/17 > 40% of Computer Forensics Cases are Child Exploitation 8.5% Year-on year growth in Smart Devices 32,600 mobile devices examined last FY Growth in volume and complexity of data Downloaded 47.8 million pictures in the last six months Perivale Car Pound: 752 vehicles for DNA & F/P in one month - we examined just 5 electronically this year TOTAL POLICING

6 Requirement to Define Uncertainty TOTAL POLICING

7 Why Define Uncertainty in DF? 1. Evidence - so we must have confidence in our results. 2. ISO Accreditation TOTAL POLICING

8 Why Define Uncertainty in DF? Criminal Practice Directions (2015) 19A.5: a. Validity of Methods, b. Safety of an opinion e.g. from statistical significance, c. Estimate Uncertainty. ISO Accreditation Use appropriate methods and procedures to estimate Uncertainty, where appropriate. TOTAL POLICING

9 Where might we look for how to ISO 17025: Sources of Uncertainty include: - Methods - Equipment - The operator UKAS M3003: Testing labs should have: - A policy for evaluating Uncertainty - Use documented procedures for evaluating Uncertainty Forensic Regulator s Codes : Refer to: - GUM - Criminal Practice Directions (2015) 19A.5c (doesn t really tell us how to do it in digital Forensics ) TOTAL POLICING

10 The GUM does tell you how to e.g. Standard Uncertainty s r N i 1 X i X N 1 2 ( but this is for Measurement ) TOTAL POLICING

11 Digital Forensic areas where we do Define Uncertainty TOTAL POLICING

12 Photo Response Non Uniformity (PRNU) Image Source camera/phone Suspect Camera CCD/CMOS sensor Fingerprint Each camera has a sensor that produces a unique noise pattern. This unique pattern is embedded in the image enabling the image to be matched to the camera that produced it!

13 R&D - Photo Response Non Uniformity (PRNU)

14 Electrical Network Frequency (ENF)

15 ENF - Match

16 A Digital Forensic area where we could Define Uncertainty (but don t) TOTAL POLICING

17 Cell Site Analysis Mobile Mobile Mobile Network Internet Voice over IP Cell Site Call Data Record Land Line Switched connections through the mobile network cause a Call Data Record (CDR) to be created The CDR contains the Mast (Sector) ID.

18 A Physical Cell Mast Mast on top of block of flats (Bromyard House)

19 Radio Frequency Propagation Survey Cell ID 30 02d0 7ce8 BROMYARD HOUSE Cell ID 30 02d0 7ce7 BROMYARD HOUSE Cell ID 30 02d CRANE HOUSE We can measure where cells provide coverage using RF survey equipment. Each dot represents where a measurement was taken. The colour of the dot indicates which cell had the best signal at that point. Here we can see the footprints of 2 cells located on the BROMYARD HOUSE mast and 1 cell located on the CRANE HOUSE mast. Notice the small islands of coverage beyond the main areas of coverage.

20 Coverage Areas BROMYARD HOUSE mast Sector 1 Cell ID 30 02d2 7ce6 Sector 3 Cell ID 30 02d2 7ce8 Sector 2 Cell ID 30 02d2 7ce7 Each antenna provides an area of coverage but it is not sharply defined

21 Coverage Areas BROMYARD HOUSE mast Sector 1 Cell ID 30 02d2 7ce6 Sector 3 Cell ID 30 02d2 7ce8 Sector 2 Cell ID 30 02d2 7ce7 Each antenna provides an area of coverage but it is not sharply defined

22 Wi-Fi Wi-Fi may be considered to be similar to Cell Site but Hotspots have much smaller coverage areas than cells. Devices record the Wi-Fi ID information - we could then RF survey the Hotspots.

23 Digital Forensic Areas where we don t Define Uncertainty TOTAL POLICING

24

25 Typical Phone Reading Equipment

26 Typical Mobile Phone Forensic Report SMS messages

27 Mobile Phone Kiosks for Rapid Results Locally MSAB Cellebrite Equipment is used by Staff & Police Officers with minimal training. Implications when we are considering uncertainty. Risk needs to be mitigated by (i) lock-down, (ii) case selection, (iii) Validation, (iv) QC

28 Computer Forensics Hard Drive

29 Device and Data Complexity is Increasing! TOTAL POLICING

30 Internet of Things! Smartphone IP Phone INTERNET

31 Strategic R & D Suspect s car was recovered burnt-out Chip off Berla ive File System mounted Data recovered includes; Frequent locations, Phone books, text messages, Call logs, and GPS

32 Unusual Casework Medical Devices Pacemaker removed from murder victim: Could we determine the time of death? - Device taken to manufacturer to recover significant event date and times. - We attempted deleted data recovery (to no avail).

33 The ValiD Project TOTAL POLICING

34 The ValiD Project ENFSI Direct Grant Project: MP2016 (Start Jan 18) Funding: EC Internal Security Fund Police Programme A database of data sets A database of tool test results Will gather statistics on Tool Performance May help estimate the Combined Uncertainty in the Method TOTAL POLICING

35 Question TOTAL POLICING

36 The Question is How do we define and evaluate Uncertainty in the areas of Digital Forensics where we haven t done so up to now? TOTAL POLICING

37 Thank You TOTAL POLICING

38 Freedom of Information Act Protective Marking Not Protectively Marked Publication Scheme Y/N: Y Title: Challenges and Opportunities for Statistics in Digital Forensics Summary: Isaac Newton Institute Cambridge 2016 Date created: 24/11/2016 Review date: - Version: 1.0 Author: Dr. James Luck (MPS) TOTAL POLICING

39 Facial Comparison (Interpretation) Used as expert evidence in UK courts for over 20 years Increase in CCTV, personal image capture devices and social media will increase demand for this type of evidence UK practitioners typically use three techniques: morphology, proportional alignment and superimposition Morphology Anthropometry Superimposition

40 Facial Comparison (Interpretation) Looking forward DEFS actively collaborates with international partners to produce best practice guidance and testing material (FBI and ENFSI) Working with academic partners and the Home Office to undertake important testing and validation of training material Working with the forensic regulator to address current quality issues in facial image comparison and other areas of image interpretation