good afternoon my name
is john bambonek here presenting
virtually adventures in pro bono digital
forensics
cases on some of the cases i've worked
on uh
in the last couple of years that i've
had some time here for
uh to work on some extra things and
we'll talk about that here in a second
as you know it's all pre-recorded if you
have questions and discord as
as we go along i'm happy to answer them
or send direct messages or if you happen
to be in las vegas
i want to catch up for drinks or coffee
i am i am available
uh certainly to talk about things that
we're going to get at the very end my
call to action
so a little bit about myself i am
president of my own company bambinac
labs primarily selling
threat intelligence fees but i do some
other consulting as well but it's my
company so i'm
fully independent uh for the time being
i am getting my phd
in cyber security machine learning but
what's relevant for this talk
is i helped develop a curriculum and
taught for about three years digital
forensics at the university of illinois
i actually don't have any current
certifications in forensics but i've
taught it
uh and have used that experience as uh
my gateway into getting judges to
approve me as an expert witness because
i've developed curriculum that others
have used and
some of my students have gone on to be
law enforcement officers and
how i teach the course actually you'll
see artifacts of how i present
this talk and and what i focus on
so uh as an aside right i am in the
lucky position to be self-employed so uh
and
basically a lifestyle company uh some of
you may be involved with startups
looking for multiples and that kind of
thing but you know when you're in a
boutique lifestyle company
it there's a lot of freedom that comes
along with it to pursue things
uh that you find interesting uh
versus things that you just have to do
because your boss tells you to do
so between that and the pandemic i used
to be part of the security vacation club
i'm sure that i've seen some of you uh
participants
you know around the united states around
the world uh that we when we used to
do that kind of a thing and not spending
time on planes
especially for international travel is
freed up a lot more time as well
so i have more time to devote to
non-income producing activities
which goes to my last point is that i
think at
this time in our society and the way
things are going
that we should get back and to use our
skills there's
we know like there's a cyber security
job shortage and we can talk about why
that is
but more importantly there's lots of
things that are lots of people in groups
that aren't getting protected right and
not just even in
the digital forensics or law enforcement
sense but
uh you know i've talked to ptas at
schools of parents who are trying to
protect their kids
and they have very little guidance i
mean they can google it uh you know
there's
any number of groups of people who have
cyber security needs
that are going unmet because they're
just folk who don't have
infinite amount of money to pay people
uh and as much as possible we should
give back obviously we have to feed our
families
and work but for the extent that some of
us can do that
i really feel strongly that we should
should do that and a spoiler alert at
the end of this talk i'm going to be
asking for your help in some of this
so here's a one-hour talk in
in one comment that really underlines
the premise of everything
uh i don't know if any of you've seen
this before you probably heard the
expression
uh i actually come from a family of
lawyers and judges well actually lawyers
judges and petty criminals
so i was built for cyber security but i
also
have a lot of legal uh a lot of inherent
legal knowledge
uh and grew up on lawyer jokes um
so here's an older one you tell black
and white right you know you have a
pretty good case mr pitkin
how much justice can you afford right is
we have a very romanticized idea
of the legal system not just a criminal
justice system but in civil court too
that hey each side can fight it out
they've got their lawyers
and you know you you you get to the
point to see who wins
well there's a lot more that goes into
that right uh you know
my own personal experience of spending
lots of money on lawyers that
um you know a lot of your outcomes
in the court system depends on how much
resources you bring to bear
and how much uh you can spend and not
just in money but in time and expertise
so here's the agenda the talk you know
we're going to talk about the legal
system a little bit
because uh usually what i try to focus
on and really beat home when i teach
forensics
is the legal aspects of what we're doing
uh you know if you're using
n case or any or celebrate the tools do
a lot of the work for you you need to
understand what they do
but the things that really can
impact the case are things that
don't aren't connected to technology
right there's uh
you know integrity of evidence in chain
of custody uh some of these things that
if you don't get right
is there goes your case right then and
there and then one of the case i'm going
to talk about
does deal with specifically of integrity
of evidence
uh we're going to deal with three cases
specifically that i've been
dealt with in a potpourri of other kind
of matters uh that touched on the legal
system
and a call to action at the end as i did
uh
mentioned before so there's a difference
between
incident response and digital forensics
right it's possible to respond to an
incident
without really doing the work of
forensics
you know at a superficial level right it
seems the same thing right
how the attackers get in how do we kick
them out how do we move forward
the difference between ir and forensics
is there's a lot of overhead
in preparing evidence for use in court
now
very few of us has ever been called to a
witness stand
but the key focus of forensics
including the latin origin of the word
is
that it's doing the work to prepare for
trials and to prepare
evidence which leads to lots of overhead
i i can
i can do incident response without
locking hard drives in a safe
um you really can't do that with digital
forensics
uh and like i said a very key point that
deals with some of the imbalances
inherent in the legal system is
um you know for those of you who are in
discord i'd be interested to see how
many of you have ever
been on a witness stand after having
done a forensic report
you know there's probably a lot of
forensic examiners listening to this
talk
that you know have written tons of
reports but
a lot of our work and a lot of the
criminal matters i work on deal with
overseas suspects right we know going in
there probably isn't going to be a trial
um you know i've had clients
and and sat them down i guess i'm not a
great businessman in this way where i've
said
okay you're dealing with ransomware you
want to sit there and try to do a tort
case to recover
your losses or whatever it's like listen
we can do the overhead of doing
forensics
you know i'll run the clock if you want
but bear in mind
we might not ever be able to get this
person to trial or probably not so
you're going to be paying me money
but i'm not going to be able to give you
a return on that
um so uh you know there's lots of that
that goes into it
uh a lot of people doing forensics work
for large large
ir firms or well-resourced and
enterprises
um you know i'm not sure it wouldn't
surprise me that they're people with law
enforcement agencies uh
that might be listening to this talk but
we have tools right you know
you've got encase or celebrate right you
know kind of the gold standards of tools
you know that you have to work with i
doubt very many
there are no forensic examiners in a
small business there probably isn't a
security guy
right you know there isn't there isn't a
forensic person you know
at your local pta or the
nursing home right the elderly have a
lot of unique cyber threats directed at
them
um you know if you think about business
email compromise
right a lot of people talk about
ransomware but business email compromise
or
more specifically romance scams there's
nobody to protect a victim against a
romance scam or or to do the work to
bring a prosecution
and that's billions of dollars lost from
that
and like i said the tools do a lot of
the heavy lifting for us
i think it's important to understand
what the tools are doing the science
behind the tools
that certainly is going to help you if
you're ever cross-examined
but it also leads to a degree of
laziness
um at the end of the day like i said
when i produce a forensic
report uh i want to stand by behind all
of it
you know not just some of it right if uh
whatever tool i'm using says
x i want to be able to explain in detail
why it says sex
if i'm cross-examined because that's my
credibility on the line
you know i can't say well this tool said
it
um you have to explain and understand
the science behind it we're going to
talk about credibility
a little bit more but this notion is
that so
very rarely is our work ever challenged
in court
uh even if even if the matter ends up in
court
there can be a little bit of not
laziness but
uh of kind of rustiness right we're not
used to being scrutinized and when you
know things
aren't going to be challenged they're
you're not as on guard you're not as
thinking through
the underlying stuff and in some matters
it might not matter
you know you may have it if you're doing
forensics for an hr investigation of
somebody doing something they shouldn't
with corporate assets
you know but in another subset of
matters the outcomes
really do have an outsized impact on on
victims and defendants and we're going
to talk about a couple of those
so in the united states and kind of most
of the british common law systems anyway
have this notion of an adversarial legal
system
right and that somewhat romanticized
each side presents their case to a judge
or to convince a jury or a judge if it's
bench trial
who is uh the trier of fact will decide
you win
or you win right and both people get
their say they get to call their experts
they get to cross-examine each other's
experts and witnesses
uh and they can get court orders to
compel evidence production right it
sounds all very fair
right if you're ever uh in a criminal
case you want to do all these things
you know i don't want to just have the
cop say yeah he
he shot that guy i want to be able to
see the body cam footage or cctv or
ballistics reports i want to be able to
get my own ballistics reports
you know we've seen a lot of how this
system works out and plays out and some
of the high profile cases we've seen
with black lives matter and others right
those are probably the most public
trials that we've had in the past couple
of years with
derek chauvin and the like where uh you
know the
the police had their experts and their
forensic examiner uh
their uh the coroner who said uh you
know george floyd died for acts
uh others brought in a different uh
corner or medical
medical experts who then uh said no it
was why
right so that's a system that
works but only in a certain
certain case right the underlying ex
assumption
is that both sides are near parity and
it's not
money necessarily money is important
that's a component
you know but it's expertise right the
only person who can question
a coroner is another medical examiner
lawyers may be able to ask some
questions but lawyers need to know a lot
of other stuff
than just technical areas of specific
classes of evidence
right you know there are areas that
lawyers are experts and they should be
experts in
and for that matter there's there's
things police need to be experts in
beyond just the handling of a certain
class of evidence if you think about
what the fbi or police officers or
detectives need to do
there's there's a whole lot that they
need to be trained and experts on
and know natively versus us right who
are experts i can focus on digital
forensics
i can give a talk on it you all can
attend to talk on it
right there's lots of police officers
with celebrities and other tools who do
the work of forensics
but don't go to talks like this or don't
have the same professional
training and experience that we do
time is a very important component uh
especially when people are on the line
and need
our people's lives are on the line and
uh
you know they're looking for certain
results in a certain time frame
um or when the government acts and
you know you're on the wrong side of the
the government's
law enforcement arm there's also
emotional energy
right is we're going to talk about this
briefly
but most cases settle uh before they
ever hit trial you know this is some
subset of cases where there's a
defendant so i was like i'm going to go
all the way i want to challenge this
and once they sit in the room and they
see their jury of 12
you know then there's a recess and they
settle it right there right because then
it becomes real to them
and that isn't a legal question that's
just an emotional energy question
but really think about just to do with a
money question of what your hourly bill
rate is if you work for an ir firm
or or what you're build out at or if
you're just a salaried
uh person who does ir in a company what
you get paid
now think of anybody in your life or
that might have need
for examining or handling digital
evidence or helping with
a cyber crime case could they pay
there's lots of small organizations
charities uh there was a small media
outlet that i helped with a ransomware
case so that wasn't forensics that was
that was just ir
and ransomware negotiation but they
didn't have any ability to pay
and their insurance policy didn't have
any room to pay me
even if i wanted to so there's lots of
people who don't have access to the same
money or expertise or time or emotional
energy
so the assumption of this adversarial
legal system
where people at near parity doesn't
really often exist
sometimes it does but very rarely
does it right and the bad news is
as for those of us who work in for large
companies or law enforcement agencies or
ir firms is we're on the powerful side
of that system
now generally the people we're
investigating with the exception of law
enforcement
is you know we're doing forensics for hr
cases
and it's usually pretty cut and dry or
we're doing forensics for a cyber crime
or an apt case
that'll probably never go to trial right
there's parody there
but that's not all of what exists there
and there's lots of people who are on
the i don't want to say wrong side but
the disadvantaged side of the criminal
or the the legal system
i mean you've got poor they can't afford
their own lawyers they got to deal with
public defenders
who have case loads that if they were in
private practice they'd be disbarred for
having
you've got other disadvantaged people
you've got persecuted i'm going to talk
about a journalist
that the government that a city
government just went after because they
were mad
even middle class people i mean we're
all upper middle class
here in this industry um i should say
there might be there might be some
entry-level people here
but by and large right you know uh as a
class people who work in cyber security
you're gonna have a pretty pretty secure
life right we're gonna do okay um
but if you think about it if you get
unjustly charged with a felony
you know a criminal defense could run a
hundred thousand dollars
do you have it i don't right you know i
said to somebody who's
like i said who had to have a lot of
retainers on lawyers over the
a lot of lawyers on retainers on lawyers
lawyers on retainer
over the years right you know i couldn't
afford that and
those made at least a little easier in
my case is that i have lawyers in my
family that i can
barter you know they do stuff for me and
i do stuff for them um
but the the hourly bill rate for lawyers
for basic stuff is
about 250 give or take right that goes
up
very you know those bills accumulate
very quickly and that could be very hard
for anybody
to pay and there's lots of matters where
you can't get
uh free you you aren't
entitled to free legal representation
right in criminal court
you need a public defender there is
legal aid for certain classes of things
but a lot of things you you may not if
you don't have the money for a lawyer
then you're arguing the case yourself
so here's some examples of bad outcomes
like i think generally the fbi does
does a good job with forensics um
you know i have no beef with card
examiners and i said generally
if i were asked to look over the work i
would expect that they probably got it
there's lots of checks and balances in
how the fbi does things
but sometimes they get it wrong um and
largely like i said it's due to things
prior
so this article uh had to deal with with
hair evidence
right is that the fbi labs you know did
various forensic examinations of hair
and we're able to get
convictions based in part on that well
eventually
somebody who's resourced enough hired
their own experts
challenged it and found out hey you know
what this
i mean this junk science you know
maybe a step above junk science you know
it ain't forensic science
right it did not have the outcomes they
did but when an fbi expert shows up and
says i did this i did this i did this
you know they got a badge people take
them at their word
unless there's somebody like me or like
you
who does the work to show that they
didn't do it
you know is when the government presents
their experts or one side presents the
experts and the other side doesn't have
any it is very very hard to impeach
their work
it really takes another expert um then
we're going to keep going to this point
in a couple of cases i'm going to talk
about all right
so this is a very bad outcome you know
for a lot of reasons is that one i mean
you had people who are potentially
wrongfully convicted that's bad
right you know but as somebody who wants
the law enforcement
system to work and actually put
criminals behind bars
right there may have been some guilty
people who walk free because of
the evidentiary areas made here right is
that i want
my my cops and the fbi and law
enforcement
to get bad guys i want to get them the
right way and make sure that they do it
correctly
because the way we've calibrated our
legal system
at least in the criminal sense is you
know beyond a reasonable doubt we err on
the side of letting bad guys go
uh and you know versus
keeping the innocent in jail it doesn't
always work out that way but
like i said there's a notion oh you got
off on a technicality
well the flip side of the request uh
that that equation is well did law
enforcement do it right
you know they have they have they have
the high bar and they should have a high
bar
so there's also lots of other worst
cases that we can point to right you can
think of any of the cases that pointed
to the black lives matter movement
and talk talking about a power
differential there right
you know there's an entire project or
there's
lots of iterations of this the innocent
project of looking at people just on
death row
going through the cases with a
fine-tooth comb and seeing if
they're in fact people on death row who
are innocent
um you might you know the outcome of
getting that wrong is irreversible
um and there have been people there been
convictions overturned it turned out
that they found people who were in fact
innocent for a wide variety of reasons
now the downside of this is also that
well i mean
you've been on death row for 20 years
you're free but you don't get your 20
years back
right you know they're not going to
execute you anymore but you've taken a
20-year break from society
right there's no restitution in some
states you can get some money
or whatever but money is a poor
substitute for time
um a lot of the times you know the
outcomes aren't just a question of
malice
right as local police have to handle
low-end cyber cases right the fbi has
their thresholds
not every cyber case is a federal case
um
you know now they're police officers you
know who who can handle it
you know i'm in a somewhat rural part of
illinois where
you know there's a couple of cops you
know who can do celebrate stuff and a
couple of
a couple of other things you know but
they have other duties as well
but they've got to handle all that and
sometimes you know
things that are complex enough or too
complex for a cop but
not uh reaching the bar of the fbi's
threshold
means things fall through the cracks
right
well but those cops are usually you know
not well trained
right you know they're they're cops
first or whatever sometimes they have a
forensic examiner who's
that's their job is to do forensics on
behalf of the police they're not badge
carriers
right um but think right you know many
of you probably invested in a gcfa or
gcfe
not cheap right you know uh would you
settle for cop pay
right when knowing your earning
potential is high elsewhere
right the fbi has a hard time retaining
cyber agents
because i can spend 10 years and then
punch out to
to work for mid mid six figures right
versus the gs pay scale some people will
still stay in for a sense of civic duty
or whatever and that's great but
it's known throughout government that
you know the pay differential between
the public and private sector is
creating some real problems
but i said you know we're on we're on
the powerful side of the unbalanced
power relationship and
uh if that makes you slightly
uncomfortable uh
that's not a bad outcome uh hopefully if
nothing else you get out of this talk is
the the need to do our jobs correctly
and diligently
even though we're probably never going
to be questioned in court
so my first case uh that i wanted to
uh bring up was uh i've started doing
some work for public defenders
i said they have immense caseloads that
wouldn't be tolerated in private
practice
they've got defendants who can't pay
that's why they have a public defender
uh and especially when you get in rural
areas there's there's no money for it
um so as a personal anecdote the only
criminal prosecution and i put
prosecution in air quotes
um uh because i think there's a couple
matters i was an expert witness on but
but by and large it's
uh just helping research and investigate
things and feed it to the bureau for
them to do their thing
but obviously like i said i've fed and
dealt with the fbi uh so it's not
exactly a conflict of interest
than being a defendant against or
helping the defense against the fbi
and it can get kind of weird right but
doing state-level work
uh for public defenders is no conflict
because i've never worked with
the illinois state police or state's
attorneys to help local prosecutions
not for any reason it's just it's never
come up the kind of things i dig into
are
large-scale billion-dollar criminal
enterprises so those are inherently
federal
um many of these public defenders have
never had a digital forensics
expert before learning their peers you
know so there's lots of things they
didn't know how to handle so it's
kind of talking through okay how to how
to engage and
and you know work with me um
and uh so i got a case right not in the
county i'm in a different one
uh but it was a csam case unfortunately
uh
referred to by the national center as a
national center of missing and
exploited children who does a lot of
work finding this stuff
identifying it on the internet finding
who's sharing it who's uploading it
uh and and getting these people uh
brought to justice and rightly so right
it's id no desire to have any of this
material on the internet
anywhere in the world right uh and
primarily uh ncmec does a lot of hash
matching sometimes actually do
image inspection to actually look at the
stuff um
and in this case it was tied to a
specific google account
so they were able to inherently trace it
to an individual
this because they've never dealt with a
private uh
digital forensics expert before right
this led to interesting questions about
evidence handling and you can kind of
you know picture the absurdity this is
like you know it's
you know all of us doing forensics right
now are primarily remote so somebody's
sending us evidence right you know so
they're saying oh you know
um you know would you like us to mail
the evidence to you on a thumb drive is
like
no no i would not because that would be
a federal crime and you can't protect me
from that
and you can't email it either right so i
mean we're you know
you know so they queried it and i still
kind of had a problem with that because
now i have something in my possession i
really don't want to have
but i mean defense are entitled to
defend their clients and they need to
see all the evidence and examine it
the fbi how they handle this is that
that
you know if you've got a federal csam
case and you've got a
defense attorney and defense experts
they're just going to have to go to the
field office or a residence agency and
look at the evidence there
on an offline on network computer and
that's just that which
is a pain but you know what considering
the subject material
uh the subject matter you know i'm okay
with that right you know if somebody was
making me jump through a bunch of hoops
for
you know some fraud case you know i'd be
irritated in this case it's like yeah
okay i get it right
um and like i said luckily like the work
i would do with this case doesn't really
involve me looking at the images i mean
the metadata the files or whatever and
the network telemetry sure
but they really had no process in place
right here to handle it
and i said they're federal questions
right you know is
you know sending it through the u.s mail
it's a federal crime sending it over
electronically as a federal crime
you know uh possession in some cases is
a federal crime right
and state can't immunize yourself from
federal charges
right so um kind of talk through that
i actually asked the fbi if they had any
you know the one deconflict is like
by the way this is what i'm doing this
is why i have it you know
which led to the the federal prosecutor
giving the prosecutor a call saying hey
let's not do this
so we'll try to i said make the work of
law enforcement better in a place that's
never dealt with this is saying hey
we need to keep this stuff in an
evidence locker somewhere you know at a
police department
and an offline computer so that if
anybody ever needed to look at it
to do the work they can but it's just
not being
transmitted or shared it's being held in
a very controlled way
so even though as a defense expert it's
not my job
to make the prosecution better at least
for this it's like
i'm glad we kind of went through this
even though it was as a very superioris
way of actually starting the case is
like hey let's
let's make sure we get the process right
in this place communicate it out
that way when it comes up later you know
it's handled correctly and it's very
important to handle this stuff correctly
so uh the ncmec identified it hashes
with upload events from specific ips
uh those were authenticated to a google
account so
kind of knew who they were um and as far
as i could tell they just said okay well
you're the only account you're the guy
all right you know off you go hear your
cuffs here's the charges
gets a public defender uh who then hears
about me and
and contacts me so
the threshold here right for a criminal
case is beyond a reasonable doubt
right the defendant says hey other
people have access to this
right i'm not the only one with a
password i
you know that's reasonable people share
passwords they shouldn't i mean we tell
them
not to but they do um
some of the ip addresses involved or
locations not connected to the defendant
right you've never been in that city
there was mobile and isp right so it was
kind of easier to
to identify locations that didn't make a
whole lot of sense
um but here's an interesting question
right is that the goals between
prosecution and defense experts are
different
right for a prosecution expert you have
to
collect all the evidence and analyze it
to create a
beyond reasonable doubt scenario that's
actually fairly hard to do with digital
evidence alone
for a lot of reasons you know any number
of things could happen to
that computer right you know even if it
was in this guy's house
did somebody else put it on his computer
or as you know
into a cloud account uh because i can't
tell that from network telemetry alone
about who's sitting at the computer you
need other stuff
and digital evidence is uh a form of
hearsay
but there's a couple of exceptions that
apply but can also be circumstantial
right so there's a lot of legal concepts
that come into play
as a defense expert right but just a
little bit different
role than i'm i'm used to is well i said
i've done
investigations of large-scale crimes
that led to federal prosecutions right
of getting to beyond a reasonable out a
defense expert i've just got to pick
enough holes to say hey you don't have
it
um right it leads to an ethical
ethical question there is you know
do i want people to traffic in this
stuff go free well
the flip side of that equation is if
you're going to shoot this shot to
charge somebody with this kind of stuff
you got to get the case um you got to
do the work to close all the loops
because
if you're being lazy maybe lazy is
unfair in this case
but not thorough that opens the door to
innocent people being charged with this
kind of crime and it is a life-altering
crime
um uh to be charged with and many people
you know
even if they're guilty you know plea out
because they don't have the resources
they don't have the emotional energy
they don't have the time
uh you know the state overcharges and
offers a deal and says
listen i'm going to put you away for 30
years or you can plea out here and take
five
you know what do you want to do do you
want to die in jail uh you know
depending on your age i guess
i'm facing 30 years in jail at my age
that could be an effective death
sentence
or five years where i can get out you
know um
yeah i may be innocent but the process
you know
that's the kind of way criminal
defendants have to do and it's not uh
it's not as simple as saying you know
what i'm innocent right you know because
everybody's heard horror stories and
knows that you know the state wants to
get you often they can and if you don't
have the money to fight
then you you got to take the lesser of
two evils
so um and and sometimes the best way to
make
prosecutors and police more effective uh
is to challenge them the adversarial
legal system works
because it makes everybody involved
better
right if you're just talking and
nobody's actually questioning you
or otherwise examining your your
findings
right you get intellectually lazy not
not in an immoral sense it's just
you know there's atrophy involved right
you know
it's always better to have somebody
challenging you
i'm challenging your your analysis and
your biases and all the things that go
into that and the more that i've done
threat intelligence and intelligence
work the more that those kind of
dynamics are
the forefront of my mind
over 90 of cases settle out very very
few actually hit
hit court of those right
very few have a defense expert
on some evidence right like the fbi hair
evidence
they're not effectively cross-examined
you need
you know an expert to question an expert
you know and i said the system works
where there's near parity it's better
for all involved because it makes us all
better
right having me questioning the work of
police or the fbi for that matter is
going to make them better
uh over the longer term right um
so i i said it's an important that this
system you know works
works as how we idealize it uh not
necessarily works how it does today for
a lot of people
so here is actually one of my favorite
pro bono cases for a wide variety of
reasons and we're going to talk about
this
i was a pro bono expert in a state level
cfa
civil prosecution um so like the federal
cfa can be used in criminal and civil
court california has
another version of that uh the case is
city of fullerton
uh versus uh friends of fullerton future
uh you can google that to find
materials because now that that case is
resolved it was
fairly public for this kind of case
defendant was a journalist he was a
blogger who
exposed municipal misconduct with an
insecure dropbox account the city had an
insecure dropbox we'll talk about that
i was connected to the case via the
electronic frontier foundation they have
a co-op text listserv
where lawyers and others can ask hey you
know we didn't expert
a pro bono sometimes paid to help with
something
it's a very low volume list but uh
it's people have nowhere else to turn
turn to the ff hey i need a technical
expert for something
uh so it's a good way to to pick up
things every now and then
but the case is kind of the nexus of
free uh of the free press the first
amendment
version of the free press right uh
publix record law and using the cfa as a
hammer against a blogger right
i'm sorry for the typo um so
i'm sure that many of you here have some
feelings about the computer fraud and
abuse act as do why
so the basics of this case blogger did a
foia request or documents notice the
dropbox had no access control
by no access control meaning you go to
the root of the folder
and walk the entire tree so for foia
responses
that doesn't really matter because we're
really talking about public records
they're seeing other people's
public records requests or the the
responses to other people's public
records requests
but it's all public records governments
are very
stupidly finicky about this stuff like
oh if you request it
then i'll produce this to you but if
somebody else requests it then we've got
to go do all this work
all over again it's part of this stupid
game many government agencies play
to prevent the public from seeing their
own
government's business
so like many cities this is this is
where we start to get into hilarious
territory
right you know they produce a documents
hey this
this guy requested these documents
here's all the documents and the lawyers
go through and say no you got to redact
this you can't produce this because this
exemption in the law
they communicated all of the unredacted
documents
to their lawyers using the same dropbox
account that was unprotected
yes the communication would be
privileged
right had they used any mechanism to
protect the information i mean literally
anything right but they chose not to
at one point i brought up as like you
know what this is actually a pretty
serious violation
of the california bar association's
legal rules right
because you need to protect privileged
communication and while your
client may communicate stuff over an
insecure channel
like making things publicly available to
the entire
planet earth you're you're the lawyer
you should be like hey
no you can't do that we need to come up
with a secure mechanism
for whatever reason they didn't so this
stuff was all sitting on the internet
uh freely available
so ferguson uh the guy involved uh
published many otherwise
uh redacted or unreleased records on
police misconduct and other matters
and as you can imagine hilarity did not
ensue
the city was quite pissed uh there was a
public records lawsuit
that was about to be filed so they
retaliated filing a computer fraud and
abuse act
accusing him of hacking the dropbox
accounts
now it wasn't just a lawsuit they talked
about this in city council meetings from
quite public they were quite public to
the press
this guy is hacking our dropbox and
stealing documents
very inflammatory defamatory language
uh if it would have gone that way so
they searched his computers as his
workplace and he's a blogger he wasn't
he wasn't paid as a journalist
uh which which led him to losing this
job because i mean you know if the
police come in and start searching
things because the stuff you're doing on
your off time
employers will tend to frown upon that
and surely the city knew what they were
doing when they did that
uh the city also hired their own uh
digital forensics expert
uh and i have that in air quotes because
he was the living embodiment of what
never to do in a digital forensic
examination right
literally his expert witness testimony
is going to be case studies in my
courses and i'm going to mention this
again
of what not to do and what not to say in
court right
the city didn't want ferguson to access
the docs
they called it hacking and unauthorized
access because they didn't explicitly
authorize him to use that part of their
publicly available website
i'm sure that you're all your brains are
all exploding
right now of this kind of preposterous
druid logic
a phrase that i tried to include in one
of my declarations in court
but the lawyer advised me that was
probably too inflammatory for an expert
witness report
right it's there's no access control
everything's live on the internet on a
web page
right there is no unauthorized access
because there's no technical control to
stop it
nothing was gone around um
they also argued because ferguson at one
point used uh
vpn i forget exactly which one he did
that anyone
uh using a vpn service no matter the
company
was him any vpn from that provider was
him
for some reason anybody who used tor was
him
and then anybody from outside the united
states was him too
i mean logical leap to logical leap to
logical elite
right so you can imagine i'm kind of a
i can be level headed but i'm also
pretty sarcastic i try to be
level-headed in in court
it was very hard to write my report
based on how absurd some of these claims
were i
i don't know if it made it in or not but
i think what no it made the cutting room
floor or went to the cutting room floor
is
you know they they makes the connections
so tenuous
is connections so illusory they border
on hallucination
right they argue vpns are hacking tools
that if you use nordvpn you're a
criminal
they argued in one of their declarations
i use this as
as my own expert is that i use a vpn to
access my campus environment when i'm a
phd student to
access the network as if i were on the u
of i campus i said well clearly that was
hacking
even though the vpn was provided to me
by the university for that express
purpose um this is the kind of arguments
they were making in court
um they're expert let me let me take let
me emphasize this point
these were arguments made by their
technical expert
right now who has i.t experience we'll
talk about him in a minute
here is the worst legal thing they did
the
absolute worst they produced dropbox
logs that they got from dropbox
they put in their filing and said here's
the proof
they enriched those logs without
disclosing how why or with what they
enriched them with
until i basically tried to reproduce
getting dropbox logs on a new account i
set up and said
they've added fields where did those
fields come from
the legal term to describe this is
corrupting the integrity of the evidence
you can enrich data
right but as a defense expert i need to
know
and have enough information from your
filings to be able to
reproduce your work i shouldn't have to
guess
so when you sign an affidavit that says
these are true and complete with no
modifications
and they're not that's also perjury
um so it got into very legally
dangerous territory for the expert and
their case quickly
because i was able to reproduce and just
like well let's see what access logs
from dropbox look like when i download
them
it's like that's not what they look like
what are they doing here
they're adding more information and then
they tried to play it off to the judge
it's like
well yeah we enrich you you enrich
evidence all the time
it's like yeah you can do that but you
can't
not disclose it until you called out on
it that's not how this works
at all so their examiner
right runs a small msp now i want to
emphasize there's a missing s from there
that's not a typo right he is not a
security provider
he manages its and telco and and help
desk and
nothing wrong with it been doing it for
over 20 years
must not be terrible you know but he
runs an msp
you look at his linkedin profiler
nothing about forensics in there
right wrote a bunch of books for john
wiley there's some network security in
there but mostly i t
related topics you know but not
everybody who does security
can do forensics right there's lots of
legal
concepts unconnected to the technology
that are very very important like
uh let me think about this integrity of
the evidence
right well i said no forensics training
that i could find
is just some guy who knew technology
were really unclear is how he got
connected to the case
as an expert but he did so we
read flagged as credentials too and just
says this guy is not a digital forensics
expert
right he may know technology but that's
not enough
so which brings me to a note about
training it's like i don't i don't much
care for the
the gatekeeping that can happen with
certifications and security generally
um but it does matter in forensics right
and that df
really shouldn't be an entry-level
career track because understanding the
technology
is more important than being able to
click the right buttons and in case or
celebrate
right um the most important part about
forensics are
are are not the technology that's the
law right we're not legal experts
but they're very specific things we need
to be legal experts on right
evidence handling namely right because
that's that's what we do that's the
service we provide
anybody can punch buttons in n case
right but it's it's the
the acquisition and analysis of digital
evidence in forensically sound matters
and there are legal ways to do that and
less than legal ways to do that
and i said the tools do the work but you
need to understand the science behind it
and that's a problem for cops is that
they get to celebrate they get taught
which buttons to push to to do things
out uh
and it works okay most of the time but
they don't understand what's going on
behind the scenes and that's i mean
that's not a criticism it's like cops
need to know a lot of different things
then sell forensics um you know
but if you're going to engage in high do
high profile criminal prosecution
you know it's not unfair to expect that
you know the government needs to bring
their a game
the case was dismissed more specifically
the city
paid the bloggers to dismiss their own
case
i don't know if i've ever seen that
right it is the bloggers
you know we're going to sue just hadn't
gotten to it yet
you know the city is like we'd like to
drop this matter and we're going to give
you some money
and we're going to give your lawyer some
money now they couldn't give me money
uh and this is an important note that i
probably should mention
right as a digital forensics examiner i
can do anything pro bono i want
what i can't do is contingency billing
where i say give me 33
or some percent of the judgment because
then my judgment
uh and my analysis is tied to a specific
outcome
uh and that creates that that's kind of
known to be a problem
and i said normally they just withdraw a
case but lots of questions about uh
constitutional on the first amendment
the eff and the media groups
uh you know got involved in the shoddy
df work led to a very untenable position
for the city to continue
and like i said i'm using this guy's
expert witness reports
in a class in classes of how not to do
it you know we have lots of case studies
of doing it correctly
i've only had theoretical cases you know
examples of how to do it poorly now i've
got something concrete so
thanks you've improved my training
so don't be lazy in your forensics
reports credibility is your most
important asset right it takes a
lifetime to earn
and one trash report away from going
away um
you know the only way to question the
expert's work is with another expert
and i said you know the the end day it's
like the city tried to railroad a
blogger
and he didn't have the resources to
fight back it took a lot of people who
stepped up to do it to help him out
so my third third case is um
if you remember charlottesville there's
a lot of related cases with dino badal
and tanya kirsch with these neo-nazi
groups
uh that raise money in cryptocurrency
for legal defense funds
uh there's several different cases
involved all torts
you did bad things so you owe the
victims money
specifically andrew anglin never showed
up the court
which is the first actual testimony i've
ever done on open court
is because he never showed up but he
commented online and fundraised over the
lawsuit so the court eventually said
even though he was evading service
he says well clearly you know about the
case and you're just being a dick so
we're going to continue
and if you don't want to show up that's
fine we're just going to have the trial
in absentia
because it was in absentia though they
needed to go through motions they
wouldn't have gone through
otherwise like you know odds are in
a trial setting i would have said this
is how i figured out what what he raised
in bitcoin
they'd examine whether it makes any
sense to hire an expert and they
probably never would have
because there's no one there to examine
me actually the judge questioned me
at several points of how i did my work
to come to this so
they needed someone to talk about how to
uh enumerate their bitcoin earnings
uh they also give me financial records
so i was uh an expert for that piece of
it
and it was based off a twitter bot i i
created several years ago to monitor
neo-nazi fundraising in bitcoin
so some interesting questions how do you
value bitcoin at the time of transfer or
what it's valued at currently do you do
the judgment in bitcoin or us dollars
this is
all new questions of law and everybody's
kind of looking at me it's like how
should we do it
well i did it at time of transfer in usd
um that was just how i did it i don't
know what the right answer is
that was just what i thought was best i
explained it and everybody accepted it
uh it's always it's in bitcoin it's easy
to get those transactions
and it led to a lot of adversarial
changes of behavior they're much more
careful
uh and nobody really buys them with
their legal defense funds because
they're not actually hiring lawyers
so obidala got a four million judgment
but judgments are easy
right it's collection is the hard part
where you've got to do the work to go
find and take the money
we're experiencing with ways to do that
in simple matters with bitcoin but it's
still
very disruptive to their finances
but bitcoin is also new there's not a
lot of case law there to work off of
um you know we're trying to create some
new case law uh
based on some technical expertise i
provided and we'll see where it goes
um and just random aside i was able you
know to take my oldest son
to drive out to a federal court in ohio
and see what this looks like right so
um you know it's an opportunity of
seeing the federal
civil trial uh that uh you know he's
interested in law and politics so
i you got to see that too
the last matter is potpourri there's
lots of other matters that i'm working
on as cyber stalking sexual harassment
cases some other public defender cases
foia cases i've got a couple of um i'm
getting a lot of trial experience or at
least
producing affidavits for courts but
there's lots of stuff out there
for people who can't pay and it just so
happens i have time
but there's still more than i can do
which leads me to my call to action
right the system is unbalanced against
those who are not sufficiently resourced
but there's a huge amount of need right
cyber stalking alone
there's probably hundreds of thousands
of cases right now
of people who need help right and it
just be locking down cell phones or
uh trying to remove key lockers or
whatever right
i said if they can't pay they don't get
help and that's diamond there's no money
to be paid with
but we have skills and experience that
can make uh big differences
uh to these people in a wide variety of
matters right
and and i said some of these you don't
necessarily need to be you know
a fully trained df person right if
somebody's dealing with
you know cyber stalking or an abusive
relationship right they're resources for
them uh there's the coalition against
soccer wear and
a couple of other resources you know
there's uh
lots of technical help that can be
provided to people
uh to help out uh you know i said if
you're gonna go in courtroom you
probably want a credential
but to help people uh to make cases even
like cyber stalking or sexual harassment
it's okay here you often need to have
all the evidence collected to give to
the detective you kind of need to do a
lot of their work for them
because they have huge caseloads like
what gets to the top of their pile
versus what doesn't you know if you give
them 99
of a case and say you need to get this
this and this and you'll have it
you know you're much you get a result
much quicker for
uh your clients or the person you're
trying to help
so i'm setting up a 501 c3 called cyber
beast mode because it just happened to
be a domain name a friend
a friend of mine had had to collect
refer and manage
these cases to help the broader society
um
you know we'll get the organizational
pieces put together that's fine
in the very early stages of it i need
people who's willing to contribute
some of their time it doesn't have to be
a lot right somebody could feel the case
here or there in a city
right there's there's one uh victim i'm
dealing with
who lives quite far from me where it'd
be very easy
if i were physically there to say okay
let's let's do this this and this
but you can't really talk people
remotely through securing their digital
lives
you could do some pieces for them um you
know some might not
need to be formally handled aren't going
to go to you know the criminal
criminal or civil court it's just
helping people
uh who are victims of crime to get their
lives back
uh so if you're able to contribute if
you want to help if this sounds
interesting to you
uh you can contact me my contact
information is going to be on the next
slide i'm on discord of course
you can find me in las vegas i'll be
here until sunday you can contact your
local local public defender
the electronic frontier foundation the
co-op tax
list uh someone anyone and contribute
right if the net result of this is that
some of you contribute you know five
hours a month to help make
people's lives better uh and in a pro
bono way
you know we're having real impact in
people's uh digital lives and online
safety
um and that would be a great outcome
from this talk
so with that i will pause for questions
i said i'm going to ask on discord uh or
set up time to
you know grab a drink here while we're
in vegas i'm on twitter
i got my email and a fairly accessible
person and
thank you for attending this talk i hope
you got some value out of it i hope you
decide to contribute and
stay in touch