Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!utcs!mnetor!seismo!nbires!hao!hplabs!hplabsc!taylor
From: taylor@hplabsc.UUCP
Newsgroups: mod.comp-soc
Subject: Re: Computer Criminology
Message-ID: <484@hplabsc.UUCP>
Date: Sat, 19-Jul-86 15:15:06 EDT
Article-I.D.: hplabsc.484
Posted: Sat Jul 19 15:15:06 1986
Date-Received: Sun, 20-Jul-86 06:42:07 EDT
Reply-To: hplabs!pyramid!utzoo!henry
Organization: Hewlett-Packard Laboratories
Lines: 50
Approved: taylor@hplabs
Reference: <471@hplabsc.UUCP>


This article is from pyramid!utzoo!henry
 and was received on Fri Jul 18 19:10:11 1986
 
> In previous means of communication, methods have been developed for
> identifying, verifying, and dating messages.  Handwriting analysis works for
> handwritten material, typed material can be matched to the typewriter on
> which it was written, etc.  Likewise, ink and paper can be dated with some
> degree of precision.  These methods don't seem to be available for
> computers.  Thus, the question: what techniques are or might become
> available to perform these functions for computer messages?

The fundamental problem here is the basic digital nature of the data.  The
whole concept of digital information is that a bit has only two valid states,
so any slight variation from the nominal voltage values (or whatever) gets
suppressed when the bit is run through the circuitry.  This means that the
rich "sidebands" of information present in handwritten or typed material
are filtered out by the digital storage and processing.  They show up again
only at the very lowest level (where everything is analog) and at the very
highest level (where the content rather than the medium is examined).

> ... It seems possible
> that one can get some sort of age estimate for items recorded in magnetic
> media (disk, tapes, etc.)...

Alas, here we run into another problem:  these media are erasable and re-
usable.  There is some possibility of recovering erased data, if it has
not been overwritten too many times.  The analog medium may retain some
traces, which are filtered out by the conversion to digital when the new
data is being read in the ordinary way.  However, I suspect it's impossible
to tell whether the *same* data has been read and rewritten recently.
So a date derived by such means could always be adjusted forward, although
not backward.

Write-once media like some optical disks are more open to such methods.

> What seems to be completely missing, however, is any way to link data
> to its source...

Here the digital storage medium tells us little or nothing, since there
are too many middlemen between the source and the storage.  HOWEVER, we
can learn something by moving from the lowest level to the highest level.
Things like word-choice patterns do differ, and statistical analysis of
such things is already recognized as a powerful tool for historical and
literary research.  Disguising the more subtle patterns is said to be
fairly difficult.  What does seem unlikely, though, is that such methods
could ever provide positive proof, as opposed to a strong hint, about
the authorship of a document.

				Henry Spencer @ U of Toronto Zoology
				{allegra,ihnp4,decvax,pyramid}!utzoo!henry