Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!decvax!yale!husc6!caip!ut-sally!pyramid!hplabs!hplabsc!taylor
From: taylor@hplabsc.UUCP (Dave Taylor)
Newsgroups: mod.comp-soc
Subject: Computer Criminology
Message-ID: <471@hplabsc.UUCP>
Date: Thu, 17-Jul-86 02:19:07 EDT
Article-I.D.: hplabsc.471
Posted: Thu Jul 17 02:19:07 1986
Date-Received: Thu, 17-Jul-86 19:02:11 EDT
Reply-To: seismo!philabs!pwa-b!mmintl!franka (Frank Adams)
Organization: Hewlett-Packard Laboratories
Lines: 43
Approved: taylor@hplabs

This article is from seismo!philabs!pwa-b!mmintl!franka (Frank Adams)
 and was received on Wed Jul 16 08:08:26 1986


Recent discussions, both here and in other newsgroups, have led me to ask a
question.  Let me first state the question, and then indulge in some
speculation.

In previous means of communication, methods have been developed for
identifying, verifying, and dating messages.  Handwriting analysis works for
handwritten material, typed material can be matched to the typewriter on
which it was written, etc.  Likewise, ink and paper can be dated with some
degree of precision.  These methods don't seem to be available for
computers.  Thus, the question: what techniques are or might become
available to perform these functions for computer messages?

There seems to be almost nothing plausible in this area.  It seems possible
that one can get some sort of age estimate for items recorded in magnetic
media (disk, tapes, etc.); I have no idea how good such estimates would be
with current technology, or how good they might become.  I know that it is
sometimes possible to read data which has been erased from a tape, and even
written over.  Presumably this can be done for disks, as well.  I somehow
doubt, however, that it is possible to recover data formerly written on a
section of memory which has been written over dozens of times since.

What seems to be completely missing, however, is any way to link data to its
source.  I not only can't come up with any plausible approaches; I have a
hard time coming up with any implausible ones.  (Time travel?)  If this is
in fact impossible, we must consider the consequences of a communications
technology which permits its users to be truly anonymous.  (This came up on
the net in the context of the libel laws -- how do you prove libel if you
can't establish that the defendant actually originated the libelous
statement?)

The prospects for real-time monitoring seem somewhat better.  I have heard
that with current technology, one can pick up the radio transmissions from
an unshielded computer, and distinguish the individual instructions being
executed.  I cannot vouch for the accuracy of this statement.

I think I've rambled on long enough, here.  Comments welcomed.

Frank Adams                           ihnp4!philabs!pwa-b!mmintl!franka
Multimate International    52 Oakland Ave North    E. Hartford, CT 06108