Foundations of digital Forensics 1

Foundations of digital Forensics 1

Computer Forensics Computer forensics is the scientific examination and analysis of data held on, or retrieved from, computer storage media in such a way that the information can be used as evidence in a court of law. 2

Computer Forensic Activities Computer forensics activities commonly include: – the secure collection of computer data – the identification of suspect data – the examination of suspect data to determine details such as origin and content – the presentation of computer-based information to courts of law – the application of a country's laws to computer practice. 3

The 3 As The basic methodology consists of the 3 As: – Acquire the evidence without altering or damaging the original – Authenticate the image – Analyze the data without modifying it 4

Basic Definition Cyber: According to the Oxford Dictionary cyber means relating to or characteristic virtual reality. Law means the System of rules which a particular country or community recognizes as regulating the actions of its members and which it may enforce by the imposition of penalties. Cyber Law & Cyber Law consists of? Cyber Law is the law governing cyber space. The Information Technology (Amendment) Act, 2008 deals with cases relating to cyber space. Cyber space includes computers, networks, software, internet, websites, e-mails, data storage devices like hard disks, USB disks, PDA’s, phones and ATM machines and so on. Cyber Law consists of cyber crime, electronic and digital signatures, intellectual property and data protection and privacy. 5

Cont. Computer crime: computer crime is a situations where a computer or network was not directly involved in a crime but still contains digital evidence related to the crime. Computer-related: computer-related is used to refer to any crime that involves computers and networks, including crimes that do not rely heavily on computers. some organizations such as the US Department of Justice and the Council of Europe use the term cybercrime to refer to a wide range of crimes that involve computers and networks. 6

Fundamental of Digital forensics 7

Language of Computer Crime Investigation Several attempts have been made to develop a standard language to describe the various aspects of computer crime investigation. Computer crime mainly refers to a limited set of offenses that are specifically defined in laws such US Computer Fraud and Abuse Act and the UK Computer Abuse Act are computer crime acts which is defined by US. These crimes include theft of computer services, unauthorized access to protected computers, software piracy and the alteration or theft of electronically stored information, extortion committed with the assistance of computers, obtaining unauthorized access to records from banks, credit card issuers, or customer reporting agencies, traffic in stolen passwords and transmission of destructive viruses or commands. 8

Cont. One of the main difficulties in defining computer crime is that situations arise where a computer or network was not directly involved in a crime but still contains digital evidence related to the crime. To accommodate this type of situation, the more general term computer-related is used to refer to any crime that involves computers and networks, including crimes that do not rely heavily on computers. Notably some organizations such as the US Department of Justice and the Council of Europe use the term cybercrime to refer to a wide range of crimes that involve computers and networks. 9

Cont. Computer forensics : Computer forensics usually refers to the forensic examination of computer components and their contents such as hard drives, compact disks, and printers. Forensic entomology : forensic entomology as "bug forensics "only to computers limits the scope of the term, neglecting important aspects of the field such as communication systems, embedded systems, and digital image, audio, and video analysis. Digital forensic science : to describe the field as a whole Digital evidence examination: . This term is specific enough to be clear in the context of digital forensic science, computer forensics, incident response, or any other situation that involves the examination of digital evidence. 10

Digital Evidence in the Courtroom Individuals processing evidence must realize that, in addition to being pertinent(relevant), evidence must meet certain standards to be admitted. The US Federal Rules of Evidence, the UK Police and Criminal Evidence Act (PACE) and Civil Evidence Act, and similar rules of evidence in other countries were established to help evaluate evidence. 1. Admissibility-Warrants The most common mistake that prevents digital evidence from being admitted by courts is that it was obtained without authorization. Generally, a warrant is required to search and seize(capture) evidence. The main exceptions are plain view, consent, and exigency. By obtaining consent to search, investigators can perform a search without a warrant but some care must be employed when obtaining consent to reduce the chance of the search being successfully challenged in court. 11

2. Authenticity and Reliability The process of determining whether evidence is worthy is called authentication. Authentication means satisfying the court that (a) the contents of the record have remained unchanged, (b) that the information in the record does in fact originate from its purported(original) source, whether human or machine, and (c) that extraneous information such as the apparent date of the record is accurate. Authentication is actually a two-step process, with an initial examination of the evidence to determine that it is what its proponent claims and, later, a closer analysis to determine. In the initial stage, it may be sufficient for an individual who is familiar with the digital evidence to testify to its authenticity. i.e. its probative value. Alternately, a system administrator can testify that log files presented in court originated from her/his system. 12

3. Casey's Certainty Scale Computers can introduce errors and uncertainty in various ways, making it difficult to assess the trustworthiness of digital evidence meaningfully. Although courts are warned to consider the computer systems involved carefully, little guidance is provided. Computer machinery may make error because of malfunctioning of hardware, the computer's mechanical apparatus. Computers may also make errors that arise out of defects in the software, the input procedures, the database, and the processing program. In view of the complex nature of the operation of computers, courts have been cautioned to take special care to be certain that the foundation is sufficient to warrant a finding of trustworthiness and that the opposing party has full opportunity to Inquire(ask) into the process by which information is fed into the computer. The certainly values (C-values) provide a method for a digital evidence examiner to denote the level of certainty he/she has in a given piece of evidence in a given context. The primary purpose of this Certainty Scale is to help others understand how much weight an examiner has given pieces of digital evidence when making 13 a

Cont. One major advantage of this Certainty Scale is that it is flexible enough to assess the evidential weight of both the process that generated a piece of digital evidence and its contents, which may be documents or statements. Another major advantage of this Certainty Scale is that it is nontechnical and therefore easily understood by non-technical people such as those found in most juries. 14

4. Best Evidence When dealing with the contents of a writing, recording, or photograph courts sometimes require the original evidence. This was originally intended to prevent a witness from misrepresenting such materials by simply accepting their testimony(witness statement) regarding the contents. With the advent of photocopiers, scanners, computers, and other technology that can create effectively identical duplicates, copies became acceptable in place of the original, unless "a genuine question is raised as to the authenticity of the original or the accuracy of the copy or under the circumstances it would be unfair to admit the copy of the original" Because an exact duplicate of most forms of digital evidence can be made, a copy is generally acceptable. In fact, presenting a copy of digital evidence is usually more desirable because it eliminates the risk that the original will be accidentally altered. 15

5. Direct versus Circumstantial Evidence Direct evidence establishes a fact. Circumstantial evidence may suggest one. It is a common misconception that digital evidence cannot be direct evidence because of its separation from the events. However, digital evidence can be used to prove facts. For example, if the reliability of a computer system is at issue, showing the proper functioning of that specific system is direct evidence of its reliability, whereas showing the proper functioning of an identical system is circumstantial. Although digital evidence is generally only suggestive of human activities, circumstantial evidence may be as weighty as direct evidence and digital evidence can be used to firmly establish facts. 16

Cont. For example, a computer logon record is direct evidence that a given account was used to log into a system at a given time but is circumstantial evidence that the individual who owns the account was responsible. Someone else may have used the individual's account and other evidence would be required to prove that he actually logged into the system. It may be sufficient to demonstrate that nobody else had access to the individual's computer or password. Alternately, other sources of digital evidence such as building security logs may indicate that the account owner was the only person in the vicinity of the computer at the time of the logon. 17

6.Hearsay Digital evidence might not be admitted if it contains hearsay because the speaker or author of the evidence is not present in court to verify its truthfulness. Evidence is hearsay where a statement in court repeats a statement made out of court in order to prove the truth of the content of the out of court statement. Similarly, evidence contained in a document is hearsay if the document is produced to prove that statements made in court are true. The evidence is excluded because the crucial aspect of the evidence, the truth of the out of court statement (oral or documentary), cannot be tested by cross-examination. 18

Cont. There are several exceptions to the hearsay rule to accommodate evidence that portrays( pictures ) events quite accurately and that is easier to verify than other forms of hearsay. Although some courts evaluate all computer-generated data as business records under the hearsay rule, this approach may be inappropriate when a person was not involved. In fact, computer-generated data may not considered hearsay at all because they do not contain human statements or they do not assert a fact but simply document an act. 19

7.Scientific Evidence In addition to challenging the admissibility of digital evidence directly, tools and techniques used to process digital evidence have been challenged by evaluating them as scientific evidence. Because of the power of science to persuade, courts are careful to assess the validity of a scientific process before accepting its results. If scientific process is found to be questionable, this may influence the admissibility or weight of the evidence, depending on the situation. In the United States, scientific evidence is evaluated using four criteria developed in 1993. These criteria are: a) whether the theory or technique can be (and has been) tested; b) whether there is a high known or potential rate of error, and the existence and maintenance of standards controlling the technique's operation; c)whether the theory or technique has been subjected to peer review and publication; d) Whether the theory or technique enjoys "general acceptance" within the relevant scientific community. 20

8. Presenting Digital Evidence Preparation is one of the most important aspects of testifying in court (National Center for Forensic Science 2003). Conclusions should be stated early in testimony rather than as a punch line at the end because there is a risk that the opportunity will not arise later. During cross-examination, attorneys (lawyer) often attempt to point out flaws and details that were overlooked by the digital investigator. The most effective response to this type of questioning is to be prepared with clear explanations and supporting evidence. In addition to presenting findings, it is necessary to explain how the evidence was handled and analyzed to demonstrate chain of custody and thoroughness of methods. Also, expect to be asked about underlying technical aspects in a relatively non-technical way, such as how files are deleted and recovered and how tools acquire and preserve digital evidence. Simple diagrams depicting these processes are strongly recommended. 21

Cyber crime Law: United State Perspective, Indian Perspective, Conductive Digital Investigation, Handling a Digital Crime Scene: Principles, Preservation, 22

4. Cyber crime Law: United State Perspective Chapter reviews how law in the United States deals cybercrime. As the United States is a federal system, there are two basic levels of cybercrime law: federal cybercrime law and state cybercrime law. U.S. law deals with the major cybercrimes: the crimes that target computers and computer systems (e.g., unauthorized access, malware, and denial of service attacks) and the crimes in which computers and computer systems are used as tools to commit traditional crimes (e.g., fraud, extortion, and child pornography). Federal Cybercrime Law State Cybercrime Law Constitutional Law Fourth Amendment Fifth Amendment and Encryption 23

1. Federal Cybercrime Law 4.1 Computer Fraud and Abuse Act It focuses on the Computer Fraud and Abuse Act such as identity theft, child pornography, and copyright and trademark offenses. Congress adopted the Computer Fraud and Abuse Act (1986), but it has since been amended on several occasions. amendments have all been designed to update certain provisions of the Act in light of advancements in computer technology Section 1030(a) makes it a federal crime to do any of the following: 1. Knowingly access a computer without authorization or exceed authorized access and obtain information that is legally protected against disclosure. 2. Intentionally access a computer without authorization or exceed authorized access and obtain information from (i) a financial institution, credit card company, or consumer reporting agency. 3. With the intent to extort money or any thing of value like (i) threat to damage a computer, (ii) threat to obtain information from, 24

4.1.1 Section 1030(a)(5) Offense: accounts for the largest number of prosecutions(legal proceeding against person), perhaps because it creates three crimes. The first consists of knowingly transmitting a program, information, code, or command and thereby intentionally damaging a protected computer. Other two are hacking, or unauthorized access, to a computer or computer system. 4.1.2 Section 1030(a)(4) Offense: As noted above, § 1030(a)(4) makes it a federal crime to access a protected computer without being authorized to do so, or by exceeding the scope of authorized access, and obtain “anything of value” and thereby further a scheme to defraud. 4.1.3 Section 1030(a)(6) Offense : makes it a crime to traffic “in any password or similar information through which a computer may be accessed without authorization” if either of two conditions are met. The first is “affects interstate or foreign commerce”; the other condition is that the computer is “used by or for the Government of the United States.” 4.1.4 Section 1030(a)(7) Offense: criminalizes the use of computer 25 technology to commit extortion.

4.2 Identity Theft: The federal criminal code contains two identity theft provisions: Section 1028(a)(7) of Title 18 of the U.S. Code defines a basic identity theft offense. makes it a federal crime to knowingly transfer, possess, or use “a means of identification of another person” without being authorized. 4.4 Copyright Infringement(against law)(Section 506(a)) Copyright infringement in the form of software piracy is a crime. For a work to be “original,” it must have “originated” with—have been created by—the author claiming the copyright; originality does not require novelty but to be original an item cannot simply be a copy of another. 4.5 Trademarks and Trade Secrets The Lanham Act is the primary source of protection for trademarks (Act of July5, 1946). It defines “trademark” as “any word, name, symbol, or device, or any combination thereof” that is used by a person or which a person has a bonafide intention to use in commerce “to identify and distinguish his or her goods from those manufactured or sold by others and to indicate the source of the goods, even if that source is unknown” (15 U.S. Code § 1127). 26

2. State cybercrime law 4.2.1 Access Crimes: Every U.S. state prohibits simple hacking (gaining unauthorized access to a computer) and aggravated hacking (gaining unauthorized access to a computer for the purpose of committing theft, vandalism, or other crimes) 4.2.2 Malware: Computer contaminant” means any set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer, computer system, or computer network without the intent or permission of the owner of the information. 4.2.3 Denial of Service: DDoS attack as “techniques or actions involving the use of one (1) or more damaged computers to damage another computer or a targeted computer system in order to shut the computer or computer system down and deny the service of the damaged computer or computer system to legitimate users”. 4.2.4 Computer Forgery: “Any person who creates, alters, or deletes any data contained in any computer or computer network, who, if such person had created, altered, or deleted a tangible document or instrument would have committed forgery shall be guilty of the crime of computer forgery”. 27

4.2.5 Computer Fraud and Theft: Computer theft can encompass any of several different crimes, including information theft, software theft, computer hardware theft, and theft of computer services. It can also encompass the theft of computer hardware . And it can consist of using a computer to steal other types of property. 4.2.6 Computer Extortion: One approach they take is to include computer extortion within the definition of computer fraud. 4.2.7 Crimes Against Children: 3 Constitutional law In the United States, constitutional law exists at two levels: The U.S. Constitution is the constitution that applies throughout the territorial Two of the U.S. Constitution’s provisions are particularly relevant to the conduct of cybercrime investigations. The Fourth Amendment & Fifth Amendment 28

4. Fourth Amendment The Fourth Amendment creates a right to be free from “unreasonable” searches and seizures(forcefully taking ownership) To be “reasonable,” a search or seizure must be conducted either a lawfully authorized search or arrest warrant. Court has applied the Fourth Amendment to areas in which technology and privacy intersect. 4.4.1 Wiretapping: Content of Communications The progress of science is not likely to stop with wire tapping. Ways may be developed by which the government, without removing papers from secret drawers, can reproduce them in court, and expose to a jury the most intimate occurrences of the home. Can it be that the Constitution affords no protection against such fraud. 4.4.2 Wiretapping: Traffic Data In a subsequent decision, the Supreme Court dealt with the related issue of whether the transmittal information—the traffic data— generated by a telephone call is private under the Fourth Amendme 29

4.4.3 Technology Not in General Public Use The Supreme Court’s 2001 decision in Kyllo v. United States is its most recent parsing of the Katz standard. The issue in Kyllo was whether “the use of a thermal- imaging device aimed at a private home from a public street to detect relative amounts of heat within the home constitutes a ‘search’ within the meaning of the Fourth Amendment” 5 Fifth Amendment and encryption The Fifth Amendment states that no one can be “forcefully to be a witness against himself” The Fifth Amendment privilege only comes into play when following element is present. The first is compulsion(power to force a person to act); the Fifth Amendment does not protect communications that are made voluntarily; The compulsion must seek to extort “testimony”—oral or written communications—from an individual because the Fifth Amendment privilege does not encompass physical evidence 30

One area in which the Fifth Amendment can come into play involves the use of encryption. Encryption can be used to protect the contents of online communications or data files stored in a computer or on other storage media. If files are encrypted with an essentially unbreakable encryption algorithm; If the owner of the files committed the key to memory, then he/she can claim the Fifth Amendment privilege and refuse that fraud. 31

Conducting Digital Investigation Digital investigations inevitably vary depending on technical factors such as the type of computing or communications device, whether the investigation is in a criminal, civil, commercial, military, or other context, and case-based factors such as the specific claims to be investigated. 6.1 Digital Investigation Process Models describe how one conducted a digital investigation tended to focus on practical stepwise approaches to solving particular investigative challenges, within the context of particular technical computing environments. Proposal of a number of models for describing investigations, which have come to be known as “process models.” motivations 1. models serve as useful points of reference for reflecting on the state and nature of the field 2. framework for training and directing research, 3. for benchmarking performance against generally accepted practice. 32

Process models have defined as linear process. For example, in 1999, McKemmish defined forensic computing as: The process of identifying, preserving, analyzing and presenting digital evidence in a manner that is legally acceptable. This activities are the basis of the process model Figure 6.1. The most common steps for conducting a complete and competent digital investigation are: 1. Preparation: Generating a plan of action to conduct an effective Digital investigation, and obtaining supporting resources and materials. 2. Survey/Identification: Finding potential sources of digital evidence (e.g., at a crime scene, within an organization, or on the Internet). 3. Preservation: Preventing changes of in situ digital evidence, including isolating the system on the network, securing relevant log files, and collecting volatile data that would be lost when the system is turned off. This step includes subsequent collection or acquisition. 4. Examination and Analysis: Searching for and interpreting trace evidence. Some process models use the terms examination and analysis interchangeably. 5. Presentation: Reporting of findings in a manner which satisfies the context of the investigation, whether it be legal, corporate, military, or any other. 33

34

6.1.1 Physical Model The overall process model has 17 phases organized into five groups: Readiness, Deployment, Physical Crime Scene Investigation, Digital Crime Scene Investigation, and Presentation, summarized in Table 6.1 for both physical and digital investigations. (Carrier & Spafford, 2004) said that A computer being investigated can be considered a digital crime scene and investigations as a subset of the physical crime scene where it is located. Physical evidence may exist around a server that was attached by an employee and usage evidence may exist around a home computer that contains contraband. Furthermore, the end goal of most digital investigation is to identify a person who is responsible and therefore the digital investigation needs to be tied to a physical investigation. 35

36

6.1.2 Staircase Model sequence of ascending stairs in Figure 6.2, provides a practical and methodical approach to conducting an effective digital investigation (Casey & Palmer, 2004). Steps are defined from bottom to top in a systematic, determined manner in an effort to present a compelling story after reaching the final step of persuasion/testimony. The categories in Figure 6.2 are intended to be as generic as possible. The unique methods and tools employed in each category tie the investigative process to a particular forensic domain. The terms located on the riser of each step are those more closely associated with the law enforcement perspective. the steps in this process often proceed simultaneously and it may be necessary to take certain steps more than once at different stages of an investigation. Finally, as with most processes, there is a relationship between successive steps. That relationship can often be described by the input and output expected at each stage, 37

38

6.1.3 Evidence Flow Model The main goal of this model is to completely describe the flow of information in a digital investigation, from the moment digital investigators are alerted until the investigation reaches its conclusion. By concentrating on the flow of information, appropriate controls can be implemented at each step of the process to handle evidentiary data, written reports, or communications relating to the investigation. 6.1.4 Subphase Model Beebe and Clark contend that most investigative process models are too high level and do not address the “more concrete principles of the investigation”. Their solution is to create a multitiered framework, taking the steps common in other models and adding subphases with defined objectives to help investigators implement each step properly. 39

As a proof of concept, Beebe and Clark use the analysis process, providing three objectives-based subphases, namely, survey, extract, and examine with the following objectives for file system analysis: 1. Reduce the amount of data to analyze 2. Assess the skill level of the suspect(s) 3. Recover deleted files 4. Find relevant hidden data 5. Determine chronology of file activity 6. Recover relevant ASCII data 7. Recover relevant non-ASCII data 8. Ascertain Internet (non-e-mail) activity history 9. Recover relevant e-mail and attachments 10. Recover relevant “personal organizer” data (e.g., calendar, address books, etc.) 11. Recover printed documents 12. Identify relevant software applications and configurations 13. Find evidence of unauthorized system modification (e.g., Trojan applications) 14. Reconstruct network-based events 40

6.1.5 Roles and Responsibilities Model The FORZA model ascends to an even higher level of abstraction by providing a framework of roles and responsibilities in digital investigations. The goal of this framework is to address not just the technical aspects of a digital investigation but also the legal and managerial issues. 6.2 Scaffolding for Digital Investigations Although such occurrences and activities are not central to digital investigations, they provide necessary scaffolding to help build a solid case. This scaffolding also includes accusation/alert, threshold considerations, and case management. In addition, digital investigators will generally have to make some form of threshold assessment to decide what level of attention to give a certain case relative to all of the other cases they are handling. 41

6.2.1 Incident Alert Every process has a starting point—a place, event, or for lack of a better term, a “shot from a starting gun” that signals that the race has begun. 6.2.2 Authorization Before approaching digital evidence, it is important to be certain that the search is not going to violate any laws 6.2.3 Threshold Considerations digital investigators must establish thresholds in order to prioritize cases and make decisions about how to allocate resources. 6.2.4 Transportation Moving evidence from the crime or incident scene back to the forensic laboratory effects of which range from loss of confidentiality to destruction of evidence. 6.2.5 Verification Assessing the completeness and accuracy of acquired data and documenting its integrity are important 6.2.6 Case Management Helps to binding together all of the activities and outcomes. 42

6.3 Applying the Scientific Method in Digital evidence Although process models that define each step of an investigation can be useful for certain purposes, such as developing procedures, they are too complex and rigid to be followed in every investigation. All steps of the investigative process are often intertwined and a digital investigator may find the need to revisit steps in light of a more refined understanding of the case. 6.3.1 Formation and Evaluation of Hypotheses 6.3.2 Preparation 6.3.3 Survey 6.3.4 Preservation 6.3.5 Examination 6.3.6 Analysis 6.3.7 Reporting and Testimony 43

6.4 Investigative Scenario: Security Breach An investigative scenario involving a network security breach is outlined here to demonstrate how the various steps in a digital investigation tie together. 6.4.1 Preparation and Case Management IT help desk. 6.4.2 Accusation or Incident Alert unusually high numbers of failed logon attempts to a server it confirms that there has been unauthorized use of the administrator account on the system 6.4.3 Assessment of Worth most valuable intellectual property. 6.4.4 Authorization Developing situation and obtains approval to gather evidence and report back any findings. 6.4.5 Survey digital investigators would waste substantial time and effort trying to locate sources of digital evidence, and might ultimately find that there was insufficient information to reach any conclusions 44

6.4.6 Preservation 6.4.7 Transportation 6.4.8 Examination 6.4.9 Analysis 6.4.10 Reporting 45

INFORMATION TECHNOLOGY (AMENDED) ACT, 2008 New communication systems and digital technology have made dramatic changes in the way. Businessmen are increasingly using computers to create, transmit and store information in electronic form instead of traditional paper documents. It is cheaper, easier to store and retrieve and speedier to communicate. Electronic commerce eliminates need for paper based transactions. The Law of Evidence is traditionally based upon paper-based records and oral witness. Hence, to facilitate e-commerce, the need for legal changes. The legal recognition to electronic records and digital signatures in turn will facilitate through the electronic communication like Internet. In May 2000 Indian Parliament passed the Information Technology Bill and came to be known as the Information Technology Act, 2000. Cyber laws are contained in the IT Act, 2000. 46

Cont. This Act was amended by Information Technology Amendment Bill 2006, passed in Loksabha on Dec 22nd and in Rajyasbha on Dec 23rd of 2008. Objectives of the IT 2008 Act are: ·Carried out by means of electronic data interchange, and other means of electronic communication, commonly referred to as "electronic commerce“ · To facilitate electronic filing of documents with Government departments · To facilitate electronic storage of data · To facilitate and give legal sanction to electronic fund transfers between banks and financial institutions · To give legal recognition for keeping of books of accounts by banker’s in electronic form. · To amend the Indian Penal Code, the Indian Evidence Act, 1872, the Banker’s Book Evidence Act, 1891, and the Reserve Bank of India Act, 1934. 47

Important section of IT act Section 1: It shall extend to the whole of India and, save as otherwise provided in this Act, it applies also to any offence committed outside India by any person. Section 2: Definitions (a) "Access" (b) "Addressee" (c) “Affixing Electronic Signature" (d) "Asymmetric Crypto System" (e) "Certifying Authority" means a person who has been granted a license to issue a Electronic Signature Certificate. (f) "Communication Device" (g) "Computer" (h) “Computer network“ (i) "Computer Resources“ means computer, communication device, computer system, computer network, data, computer database or software; 48

(j) "Controller" means the Controller of Certifying Authorities (k) "Data" means a representation of information, knowledge, facts, concepts or instructions Section 3: Defines Digital Signatures The authentication to be affected by use of asymmetric crypto system and hash function Section 4 Legal Recognition of Electronic Records Where any law provides that information or any other matter shall be in writing or in the typewritten or printed form, then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied if such information or matter is (a) rendered or made available in an electronic form; and (b) accessible so as to be usable for a subsequent reference 49

Section 5: Legal recognition of Electronic Signature Section 6: Use of Electronic Records and Electronic Signature in Government and its agencies Where any law provides for 1. the filing of any form 2. the issue or grant of any license, 3. the receipt or payment of money in a particular manner, Section 7 : Retention of Electronic Records Section 8: Publication of rules, regulation, etc, in Electronic Gazette Section 11: Attribution of Electronic Records An electronic record shall be attributed to the originator Section 12: Acknowledgement of Receipt Section 14: Secure Electronic Record 50

Section 16 : Security procedures and Practices (Amended vide ITAA 2008) The Central Government may for the purposes of sections 14 and 15 prescribe the security procedures. It is regard to the commercial circumstances, nature of transactions and such other related factors as it may consider appropriate. Section 17: Appointment of Controller and other officers Section 18: The Controller may perform all or any of the following functions, namely (a) exercising supervision over the activities of the Certifying Authorities; (b) certifying public keys of the Certifying Authorities (c) laying down the standards to be maintained by the Certifying Authorities; (d) specifying the qualifications and experience which employees of the Certifying Authorities should possess; (e) specifying the conditions subject to which the Certifying Authorities 51 shall conduct their business;

Section 21: License to issue electronic signature certificates A license granted under this section shall – (a) be valid for such period as may be prescribed by the Central Government; (b) not be transferable (c) be subject to such terms and conditions as may be specified by the regulations. Section 23: Renewal of license Section 29: Access to computers and data Section 37: Suspension of Digital Signature Certificate Section 40: Generating Key Pair Section 43: Penalty for damage to computer, computer system, etc If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network 52

(a) accesses or secures access to such computer, computer system or computer network or computer resource (ITAA2008) (b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; (c) introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network; Section 52: Salary allowance and other terms and conditions of service of Chairperson and Member. The salary and allowances payable to, and the other terms and conditions of service including pension, gratuity and other retirement benefits Section 53: Filling up of vacancies (Amended vide ITAA 2008) If, for reason other than temporary absence, any vacancy occurs in the office of Chairperson or Member as the case may be then the Central Government shall appoint another person in accordance with the provisions of this Act 53

Section 62: Appeal to High court Any person aggrieved by any decision or order of the Cyber authority may file an appeal to the High Court within sixty days from the date of communication of the decision or order of the Cyber Appellate Tribunal to him on any question of fact or law Section 65: Tampering with Computer Source Documents shall be punishable with imprisonment up to three years, or with fine which may extend up to two lakh rupees, or with both. Section 66: Computer Related Offences (Substituted vide ITAA 2008) imprisonment for a term which may extend to two three years or with fine which may extend to five lakh rupees or with both. Section 71 Penalty for misrepresentation imprisonment for a term which may extend to two years, or with fine which may extend to one lakh rupees, or with both Section 85 Offences by Companies 54

Modus Operandi Modus operandi (MO) is a Latin term that means "a method of operating." It refers to the behaviors that are committed by a criminal for the purpose of successfully completing an offense. A criminal's MO consists of learned behaviors that can evolve and develop over time. It can be refined, as an offender becomes more experienced, sophisticated, and confident. It can also become less competent and less skilful over time, decompensating by virtue of a deteriorating mental state, or increased used of mind-altering substances. an offender's MO behavior is functional by its nature. It most often serves (or fails to serve) one or more of three purposes: protects the offender's identity; ensures the successful completion of the crime; facilitates the offender's escape. 55

Motive & Technology The term motive refers to the emotional, psychological, or material need that impels, and is satisfied by, a behavior. Criminal motive is generally technology independent. Classifying offenders - to classifying offense behaviors (turning it from an inductive labeling system to a deductive tool). They include the following types of behaviors: Power Reassurance Power Assertive Anger Retaliatory (Sadistic) Opportunistic and Profit oriented. 56

Thank You 57