Digital Evidence Challenges: Connected Devices and The Internet of Things (IoT)

Transcription

1 The Internet of Things Collection challenges Digital Evidence Challenges: Connected Devices and The Internet of Things (IoT) FRE th September, 2017 Records Management

2 Computer Forensics Set Processes Foundations for data collections standards in place 20+ years ago Hash value matching, exact replica s of media/dataset, documentation Recent remote imaging technologies adopted (circa. 2008) In response to a remote workforce and geographic challenges Now everything is different Connected device data is constantly changing and cannot be validated in the same manner

3 My car sends secret messages

4 (IoT) Journey to Chicago ( ) Alexa, weather for area, dry cleaning pickup, check in online, check in hotel (select room), drive to airport (EZ tag), set home alarm, use smart park app, TSA pre-check, airline club, personal hotspot to download , pay credit card online, re-assign seat for flight, board plane (electronic boarding pass), audio book, Spotify, Wi-Fi on flight (VPN), review business documents, save on cloud storage, check in for return flight, send/receive , land, Uber to hotel, go straight to room (Bluetooth key).

5 (IoT) Journey to Chicago ( ) Alexa, weather for area, dry cleaning pickup, check in online, check in hotel (select room), drive to airport (EZ tag), set home alarm, use smart park app, TSA pre-check, airline club, personal hotspot to download , pay credit card online, re-assign seat for flight, board plane (electronic boarding pass), audio book, Spotify, Wi-Fi on flight (VPN), review business documents, save on cloud storage, check in for return flight, send/receive , land, Uber to hotel, go straight to room (Bluetooth key). 632MB new ESI created in less than 6 hours (equivalent to approx. 300,000 pages if printed)

6 Connected World 3.3 billion Internet users worldwide Same as world population in 1965 Estimated 21 billion things connected to the Internet (growing by 215 per second) What is a thing (Internet of Things)?

7 Defining the Internet of Things Internet Definition: is the inter-networking of physical devices, vehicles (also referred to as "connected devices" and "smart devices"), buildings, and other items embedded with electronics, software, sensors, actuators, and network connectivity which enable these objects to collect and exchange DATA. Urban Dictionary Definition: In the tech world, it stands for Internet of Things"; literally means physical objects with internet capabilities such as smart watches, cars, buildings, etc

8 Internet of Things (IoT) The Internet of Things (IoT) refers to the ever-growing network of physical objects that feature an IP address for Internet connectivity, and the communication that occurs between these objects and other Internetenabled devices and systems What can be connected to IoT? How many things can be connected? 340,282,366,920,938,463,463,374,607,431,768,211,456 We could assign an IPV6 address to EVERY ATOM ON THE SURFACE OF THE EARTH, and still have enough addresses left to do another 100+ earths. It isn t remotely likely that we ll run out of IPV6 addresses at any time in the future. Steve Leibson

9 Types of Devices The Old

10 Types of Devices The New Remember, the maximum number of devices is 340,282,366,920,938,463,463,374,607,431,768,211,456

11 50 Billion IoT devices by 2020 Source: 11

12 Security Risk?

13 Recent Headlines

14 How can IOT data impact my matter? Oil Platform Explosion Vehicle Forensics Mud Gas Log

15 You will have to ask differently Data collections will be different Volatile data means you cannot rely on hash values This is already the case with some social media and cellphone collections Documentation will be different Self-Collection may be impossible to validate The collection may be a moment in time that can never be replicated FRE 902 Amendments (December 2017) Comes at a good time!

16 FRE 902 paragraphs (13) and (14) The new additions to Rule 902, paragraphs (13) and (14), allow for authentication of electronic evidence by an affidavit of a qualified person who can certify in writing that the document was obtained within the requirements of Rule 902(11) and (12). ( Rule 902(14) As the Advisory Committee on Evidence notes, [t]he rule is flexible enough to allow certifications through processes other than comparison of hash value, including by other reliable means of identification provided by future technology. (Fed. R. Evid. 902(14) (Proposed Amendment 2016) Advisory Committee s note to 2016 amendment) The key will be best practices which may differ by device

17 Discussion David A. Greetham Vice President, ediscovery Sales and Operation linkedin.com/in/davidgreetham

18