Handbook of Information Security Management:Law, Investigation, and Ethics

Previous Table of Contents Next


The answers to these questions may have an effect on who is called in to conduct the investigation. Furthermore, these objectives must be addressed early on, so that the proper authorities can be notified if required. Prosecuting an alleged criminal offense is a time-consuming task. Law enforcement and the prosecutor expect a commitment of time and resources for:

  Interviews to prepare crime reports and search warrant affidavits.
  Engineers or computer programmers to accompany law enforcement on search warrants.
  Assistance of the victim company to identify and describe documents, source code, and other found evidence.
  A company expert who may be needed for explanations and assistance during the trial.
  Documents which may need to be provided to the defendant’s attorney for discovery. They may ask for more than the organization may want to provide. The plaintiff’s (i.e., victim’s organization) attorney will have to argue against broad-ranging discovery. Defendants are entitled to seek evidence that they need for their defense.
  Company employees will more than likely be subpoenaed to testify.

Who Should Conduct the Investigation?

Based on the type of investigation (i.e., civil, criminal, or insurance) and extent of the abuse, the victim must decide who is to conduct the investigation. This used to be a straightforward decision, but high-technology crime has altered the decision-making process. Inadequate and untested laws, combined with the lack of technical training and technical understanding, has severely hampered the effectiveness of the criminal justice system when dealing with computer-related crimes.

In the past, society would adapt to change, usually at the same rate of that change. Today, this is no longer true. The information age has ushered in dramatic technological changes and achievements, which continue to evolve at exponential rates. The creation, the computer, is being used to create new technologies or advance existing ones. This cycle means that changes in technology will continue to occur at an increasing pace. What effect does this have on the system of law? How new laws will be established must be examined. The process must be adapted to account for the excessive rate of change. While this is taking place, if an investigation is launched, the victim must choose from these options:

  Conduct an internal investigation.
  Bring in external private consultants or investigators.
  Bring in local, state, or federal law enforcement officials.

Exhibit 1 identifies each of these tradeoffs. Law enforcement officers have greater search and investigative capabilities than private individuals, but they also have more restrictions than private citizens. For law enforcement to conduct a search, a warrant must first be issued. Issuance of the search warrant is based on probable cause (i.e., reason to believe the something is true). Once probable cause has been identified, law enforcement officers have the ability to execute search warrants, subpoenas, and wire taps. The warrant process was formed to protect the rights of the people. The Fourth Amendment established:

Exhibit 1. Tradeoffs for Each Group Conducting an Investigation
Group Cost Legal Issues Information Dissemination Investigative Control

Internal Investigators Time/People Resources Privacy Issues
Limited Knowledge of Law and Forensics Controlled Complete
Private Consultants Direct Expenditure Privacy Issues Controlled Complete
Law Enforcement Officers Time/People Resources Fourth Amendment Issues
Jurisdiction Uncontrolled Public Information (FOIA) None
Miranda
Privacy Issues

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

There are certain exceptions to this. The “exigent circumstances” doctrine allows for a warrantless seizure, by law enforcement, when the destruction of evidence is impending. In United States v. David the court held that “When destruction of evidence is imminent, a warrantless seizure of that evidence is justified if there is probable cause to believe that the item seized constitutes evidence of criminal activity.”

Internal investigators (i.e., nongovernment) or private investigators, acting as private citizens, have much more latitude in conducting a warrantless search, due to a ruling by the Supreme Court in Burdeau v. McDowell . In this case, the Court held that evidence obtained in a warrantless search could be presented to a grand jury by a government prosecutor, because there was no unconstitutional government search and hence no violation of the Fourth Amendment.

Normally, a private party or citizen is not subject to the rules or laws governing search and seizure, but a private citizen becomes a police agent, and the Fourth Amendment applies, when:

  The private party performs a search for which the government would need a search warrant to conduct.
  The private party performs that search to assist the government, as opposed to furthering its own interest.
  The government is aware of that party’s conduct and does not object to it.

The purpose of this doctrine is to eliminate the opportunity for government to circumvent the warrant process by eliciting the help of a private citizen. If a situation required law enforcement to obtain a warrant, due to the subject’s expectations of privacy, and the government knowingly allowed a private party to conduct a search to disclose evidence, the court would probably rule that the private citizen acted as a police agent. A victim acting to protect his or her property by assisting police to prevent or detect a crime does not become a police agent.


Previous Table of Contents Next




Network Security Library - All you want to know about Windows, UNIX, NetWare, WWW, Firewalls, Intrusion Detection Systems, Security Policy, etc.