HANDBOOK OF INFORMATION SECURITY Threats, Vulnerabilities, Prevention,Detection, and Management Volume 2

Barker National Institute of Standards and Technology E-Government Security Issues and Measures Kent Belasco First Midwest Bank Online Retail Banking: Security Concerns, Breaches, and Co

Trang 3

OF

INFORMATION

SECURITY Information Warfare; Social, Legal, and International Issues;

and Security Foundations

Trang 4

JWBS001-FM-Vol.II WL041/Bidgolio-Vol I WL041-Sample-v1.cls November 11, 2005 12:47 Char Count= 0

This book is printed on acid-free paper. ∞

Published by John Wiley & Sons, Inc., Hoboken, New Jersey

Published simultaneously in Canada

No part of this publication may be reproduced, stored in a retrieval system, ortransmitted in any form or by any means, electronic, mechanical, photocopying,recording, scanning, or otherwise, except as permitted under Section 107 or 108 ofthe 1976 United States Copyright Act, without either the prior written permission ofthe Publisher, or authorization through payment of the appropriate per-copy fee tothe Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978)750-8400, fax (978) 646-8600, or on the web at www.copyright.com Requests to thePublisher for permission should be addressed to the Permissions Department, JohnWiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201)748-6008, or online at http://www.wiley.com/go/permissions

Limit of Liability/Disclaimer of Warranty: While the publisher and author haveused their best efforts in preparing this book, they make no representations or war-ranties with respect to the accuracy or completeness of the contents of this bookand specifically disclaim any implied warranties of merchantability or fitness for aparticular purpose No warranty may be created or extended by sales representatives orwritten sales materials The advice and strategies contained herein may not be suitablefor your situation The publisher is not engaged in rendering professional services, andyou should consult a professional where appropriate Neither the publisher nor authorshall be liable for any loss of profit or any other commercial damages, including butnot limited to special, incidental, consequential, or other damages

For general information on our other products and services please contact ourCustomer Care Department within the U.S at (800) 762-2974, outside the United States

at (317) 572-3993 or fax (317) 572-4002

Wiley also publishes its books in a variety of electronic formats Some contentthat appears in print may not be available in electronic books For more informationabout Wiley products, visit our web site at www.Wiley.com

Library of Congress Cataloging-in-Publication Data:

The handbook of information security / edited by Hossein Bidgoli

p cm

Includes bibliographical references and index

ISBN-13: 978-0-471-64830-7, ISBN-10: 0-471-64830-2 (CLOTH VOL 1 : alk paper)ISBN-13: 978-0-471-64831-4, ISBN-10: 0-471-64831-0 (CLOTH VOL 2 : alk paper)ISBN-13: 978-0-471-64832-1, ISBN-10: 0-471-64832-9 (CLOTH VOL 3 : alk paper)ISBN-13: 978-0-471-22201-9, ISBN-10: 0-471-22201-1 (CLOTH SET : alk paper)

1 Internet–Encyclopedias I Bidgoli, Hossein

Trang 5

To so many fine memories of my mother, Ashraf, my father,Mohammad, and my brother, Mohsen, for their uncompromising

belief in the power of education

iii

Trang 6

iv

Trang 7

About the Editor-in-Chief

Hossein Bidgoli, Ph.D., is professor of Management

Information Systems at California State University Dr

Bidgoli helped set up the first PC lab in the United

States He is the author of 43 textbooks, 27 manuals

and over five dozen technical articles and papers on

var-ious aspects of computer applications, information

sys-tems and network security, e-commerce and decision

sup-port systems published and presented throughout the

world Dr Bidgoli also serves as the editor-in-chief of The

Internet Encyclopedia and the Encyclopedia of Information Systems.

The Encyclopedia of Information Systems was the ient of one of the Library Journal’s Best Reference Sources for 2002 and The Internet Encyclopedia was recipient of

recip-one of the PSP Awards (Professional and Scholarly lishing), 2004 Dr Bidgoli was selected as the CaliforniaState University, Bakersfield’s 2001–2002 Professor of theYear

Pub-v

Trang 8

vi

Trang 10

viii

Trang 11

Part 1: Key Concepts and Applications

Related to Information Security

Hossein Bidgoli

Nirvikar Singh

Kent Belasco and Siaw-Peng Wan

Digital Libraries: Security and Preservation

Groupware: Risks, Threats, and Vulnerabilities

Pierre Balthazard and John Warren

Search Engines: Security, Privacy, and

Shannon Schelin and G David Garson

Robert H Greenfield and Daryle P Niedermayer

Robert W Heath Jr., William Bard, and Atul A Salvekar

Wayne C Summers

Lynn A DeNoia

Sherali Zeadally, Priya Kubher, and Nadeem Ansari

ix

Trang 12

C ONTENTS

x

Dale R Thompson and Amy W Apon

Client/Server Computing: Principles and Security

Tarek F Abdelzhaer and Chengdu Huang

Mohamed Eltoweissy, Stephan Olariu,

and Ashraf Wadaa

Mohsen Guizani and Anupama Raju

Air Interface Requirements for Mobile Data

Harald Haas

Abbas Jamalipour

Michele Luglio and Antonio Saitto

Peter L Heinzmann

Pietro Michiardi and Refik Molva

Part 3: Standards and Protocols for Secure Information Transfer

Istv án Zsolt Berta, Levente Butty án, and Istv án Vajda

A Meddeb, N Boudriga, and M S Obaidat

Lillian N Cassel and Cynthia Pandolfo

Prashant Krishnamurthy

Lorrie Faith Cranor

Volume II: Information Warfare; Social, Legal, and International Issues; and Security Foundations

Part 1: Information Warfare

Trang 13

C ONTENTS xi

Thomas M Chen, Jimi Thompson, and Matthew C Elder

Peng Liu, Meng Yu, and Jiwu Jing

Part 2: Social and Legal Issues

The Legal Implications of Information Security:

Blaze D Waleski

David Dittrich and Kenneth Einar Himma

Paul A Taylor and Jan Ll Harris

William A Zucker and Scott Nathan

Law Enforcement and Computer Security Threats

Mathieu Deflem and J Eagle Shutt

Combating the Cybercrime Threat: Developments

Kenneth Einar Himma

Jonathan Wallace

Charles Jaeger

Cyberlaw: The Major Areas, Development,

Dennis M Powers

Julia Alpert Gladstone

Susanna Frederick Fischer

Magnus Daum and Hans Dobbertin

Xukai Zou and Amandeep Thukral

Helger Lipmaa

Robin C Stuart

Trang 14

C ONTENTS

xii

M A Suhail, B Sadoun, and M S Obaidat

J Philip Craiger, Jeff Swauger, and Mark Pollitt

Computer Forensics—Computer Media Reviews

Michael R Anderson

Dario V Forte

Steve J Chapin and Chester J Maciag

Volume III: Threats, Vulnerabilities,

Prevention, Detection, and

Management

Part 1: Threats and Vulnerabilities

to Information and Computing

Mak Ming Tak, Xu Yan, and Zenith Y W Law

David Harley

Sviatoslav Braynov

Qijun Gu, Peng Liu, and Chao-Hsien Chu

Song Fu and Cheng-Zhong Xu

Nicko van Someren

Michael Tunstall, Sebastien Petit, and Stephanie Porte

Charles Border

Slim Rekhis, Noureddine Boudriga, and M S Obaidat

Dawn Alexander and April Giles

Trang 15

C ONTENTS xiii

Michael Gertz and Arnon Rosenthal

Normand M Martel

S De Capitani di Vimercati, S Paraboschi,

and Pierangela Samarati

David Dittrich and Kenneth Einar Himma

Part 3: Detection, Recovery, Management, and Policy Considerations

Peng Ning and Sushil Jajodia

Giovanni Vigna and Christopher Kruegel

Marco Cremonini

The Use of Agent Technology for Intrusion

Dipankar Dasgupta

Marco Cremonini and Pierangela Samarati

Computer Security Incident Response

Raymond R Panko

K Rudolph

Rick Kazman, Daniel N Port, and David Klappholz

Selahattin Kuru, Onur Ihsan Arsun, and Mustafa Yildiz

Mohamed Hamdi, Noureddine Boudriga, and M S Obaidat

Asset–Security Goals Continuum: A Process

Margarita Maria Lenk

Richard E Smith

Trang 16

C ONTENTS

xiv

Mark Stamp and Ali Hushyar

Nicole Graf and Dominic Kneeshaw

Timothy E Levin, Cynthia E Irvine, and Evdoxia

Trang 17

Computer Forensics—Computer Media Reviews

in Classified Government Agencies

Nadeem Ansari

Wayne State University

Home Area Networking

Amy W Apon

University of Arkansas

Public Network Technologies and Security

Onur Ihsan Arsun

Isik University, Turkey

Security Insurance and Best Practices

Vijay Atluri

Rutgers University

Mobile Commerce

Pierre Balthazard

Arizona State University

Groupware: Risks, Threats, and Vulnerabilities

in the Internet Age

William Bard

The University of Texas, Austin

Digital Communication

William C Barker

National Institute of Standards and Technology

E-Government Security Issues and Measures

Kent Belasco

First Midwest Bank

Online Retail Banking: Security Concerns, Breaches, and Controls

Istv ´an Zsolt Berta

Budapest University of Technology and Economics,Hungary

Standards for Product Security Assessment

Bhagyavati

Columbus State University

E-Mail and Instant Messaging

Hossein Bidgoli

California State University, Bakersfield

Guidelines for a Comprehensive Security System Internet Basics

Gerald Bluhm

Tyco Fire & Security

Patent Law

Andrew Blyth

University of Glamorgan, Pontypridd, UK

Computer Network Operations (CNO)

Sviatoslav Braynov

University of Illinois, Springfield

E-Commerce Vulnerabilities

Susan W Brenner

University of Dayton School of Law

Cybercrime and the U.S Criminal Justice System

Roderic Broadhurst

Queensland University of Technology

Combating the Cybercrime Threat: Developments

in Global Law Enforcement

Christopher L T Brown

Technology Pathways

Evidence Collection and Analysis Tools

Duncan A Buell

University of South Carolina

Number Theory for Information Security The Advanced Encryption Standard

Levente Butty ´an

Budapest University of Technology and Economics,Hungary

Trang 18

Pennsylvania State University

Hacking Techniques in Wired Networks

Fred Cohen

University of New Haven

The Use of Deception Techniques: Honeypots

and Decoys

J Philip Craiger

University of Central Florida

Computer Forensics Procedures

and Methods Law Enforcement and Digital Evidence

Lorrie Faith Cranor

Carnegie Mellon University

P3P (Platform for Privacy Preferences

Project)

Marco Cremonini

University of Milan, Italy

Contingency Planning Management

Network-Based Intrusion Detection Systems

Ruhr University Bochum, Germany

Hashes and Message Digests

Jaime J Davila

Hampshire College

Digital Divide

S De Capitani di Vimercati

Universit `a di Milano, Italy

Access Control: Principles And Solutions

Mathieu Deflem

Law Enforcement and Computer Security

Threats and Measures

Lynn A DeNoia

Rensselaer Polytechnic Institute

Wide Area and Metropolitan Area Networks

David Dittrich

University of Washington

Active Response to Computer Intrusions

Hackers, Crackers, and Computer Criminals

Hans Dobbertin

Ruhr University Bochum, Germany

Hashes and Message Digests

Hans-Peter Dommel

Santa Clara University

Routers and Switches

Susanna Frederick Fischer

Columbus School of Law, The Catholic University

of America

Internet Gambling

Dario V Forte

University of Milan, Crema, Italy

Forensic Analysis of UNIX Systems

Allan Friedman

Harvard University

Peer-to-Peer Security

Song Fu

Mobile Code and Security

DoCoMo USA Labs

IBE (Identity-Based Encryption)

Johns Hopkins University

Protecting Web Sites

Julia Alpert Gladstone

Trang 19

Independent Information Security Consultant

S/MIME (Secure MIME)

Qijun Gu

Mohsen Guizani

Western Michigan University

TCP over Wireless Links

David Harley

NHS Connecting for Health, UK

E-Mail Threats and Vulnerabilities

University of Applied Sciences, Eastern Switzerland

Security of Broadband Access Networks

Kenneth Einar Himma

Seattle Pacific University

Active Response to Computer Intrusions Legal, Social, and Ethical Issues of the Internet Hackers, Crackers, and Computer Criminals

Chengdu Huang

University of Virginia

Security and Web Quality of Service

Ali Hushyar

San Jose State University

Multilevel Security Models

Renato Iannella

National ICT, Australia (NICTA)

Digital Rights Management

Cynthia E Irvine

Naval Postgraduate School

Quality of Security Service: Adaptive Security Security Policy Enforcement

Southern Oregon University

E-Education and Information Privacy and Security

Charles Jaeger

Cyberterrorism and Information Security Spam and the Legal Counter Attacks

Sushil Jajodia

George Mason University

Intrusion Detection Systems Basics

Markus Jakobsson

Indiana University, Bloomington

Cryptographic Privacy Protection Techniques Cryptographic Protocols

Abbas Jamalipour

University of Sydney, Australia

Wireless Internet: A Cellular Perspective

University of Hawaii, Manoa

Risk Management for IT Security

Wooyoung Kim

University of Illinois, Urbana-Champaign

Web Services

Nancy J King

Oregon State University

E-Mail and Internet Use Policies

Stevens Institute of Technology

Technical University, Vienna, Austria

Host-Based Intrusion Detection

Priya Kubher

Trang 20

Zenith Y W Law

JustSolve Consulting, Hong Kong

Fixed-Line Telephone System Vulnerabilities

Margarita Maria Lenk

Colorado State University

Asset–Security Goals Continuum: A Process for Security

Arjen K Lenstra

Lucent Technologies Bell Laboratories

and Technische Universiteit Eindhoven

Naval Postgraduate School

Quality of Security Service: Adaptive Security

John Linn

RSA Laboratories

Identity Management

Helger Lipmaa

Cybernetica AS and University of Tartu, Estonia

Secure Electronic Voting Protocols

Peng Liu

University of Rome Tor Vergata, Italy

Security of Satellite Networks

Chester J Maciag

Air Force Research Laboratory

Forensic Analysis of Windows Systems

Normand M Martel

Medical Technology Research Corp

Medical Records Security

Prabhaker Mateti

Wright State University

Hacking Techniques in Wireless Networks

TCP/IP Suite

Cavan McCarthy

Louisiana State University

Digital Libraries: Security and Preservation

Considerations

Patrick McDaniel

Computer and Network Authentication

Mark Michael

Research in Motion Ltd., Canada

Physical Security Measures Physical Security Threats

Pietro Michiardi

Institut Eurecom, France

Ad Hoc Network Security

Brent A Miller

IBM Corporation

Bluetooth Technology

Refik Molva

Institut Eurecom, France

Ad Hoc Network Security

CGI Group Inc

Security in Circuit, Message, and Packet Switching

Peng Ning

North Carolina State University

Intrusion Detection Systems Basics

Trang 21

C ONTRIBUTORS xix

Server-Side Security Wireless Local Area Networks VPN Basics

S Obeidat

Arizona State University

Wireless Local Area Networks

Stephan Olariu

Old Dominion University

Security in Wireless Sensor Networks

Computer Security Incident Response Teams (CSIRTs)

Digital Signatures and Electronic Signatures Internet Security Standards

G I Papadimitriou

Aristotle University, Greece

VPN Basics Wireless Local Area Networks

C Papazoglou

Aristotle University, Greece

VPN Basics

S Paraboschi

Universit `a di Bergamo, Italy

Access Control: Principles and Solutions

Radia Perlman

Sun Microsystems Laboratories

PKI (Public Key Infrastructure)

Sebastien Petit

Gemplus, France

Smart Card Security

Thomas L Pigg

Jackson State Community College

Conducted Communications Media

Stephanie Porte

Gemplus, France

Smart Card Security

Dennis M Powers

Cyberlaw: The Major Areas, Development, and Information Security Aspects

Anupama Raju

Western Michigan University

TCP over Wireless Links

Jeremy L Rasmussen

Sypris Electronics, LLC

Password Authentication

Indrajit Ray

Colorado State Univesity

Electronic Payment Systems

Julian J Ray

University of Redlands

Business-to-Business Electronic Commerce

Michigan State University, East Lansing

Managing A Network Environment

Universit `a degli Studi di Milano, Italy

IP Multicast and Its Security

Native Intelligence, Inc

Implementing a Security Awareness Program

B Sadoun

Al-Balqa’ Applied University, Jordan

Digital Watermarking and Steganography

Universit `a di Milano, Italy

Access Control: Principles and Solutions Contingency Planning Management

Shannon Schelin

The University of North Carolina, ChapelHill

E-Government

Trang 22

Law Enforcement and Computer Security

Threats and Measures

Computer Viruses and Worms

Digital Courts, the Law and Evidence

Hoax Viruses and Virus Alerts

Mobile Devices and Protocols

Technical Vocational Educational School of Computer

Science of Halandri, Greece

Quality of Security Service: Adaptive Security

Multilevel Security Models

Philip Statham

CESG, Cheltenham, Gloucestershire, UK

Issues and Concerns in Biometric IT Security

Charles Steinfield

Michigan State University

Click-and-Brick Electronic Commerce Electronic Commerce

Columbus State University

Local Area Networks

Jeff Swauger

University of Central Florida

Law Enforcement and Digital Evidence

Mak Ming Tak

Hong Kong University of Science andTechnology, Hong Kong

Fixed-Line Telephone System Vulnerabilities

Thomas D Tarman

Sandia National Laboratories

Security for ATM Networks

Okechukwu Ugweje

The University of Akron

Radio Frequency and Wireless Communications Security

Istv ´an Vajda

Budapest University of Technology andEconomics, Hungary

S Rao Vallabhaneni

SRV Professional Publications

Auditing Information Systems Security

Nicko van Someren

nCipher Plc., UK

Cryptographic Hardware Security Modules

Trang 23

C ONTRIBUTORS xxi

Phil Venables

Institute of Electrical and Electronics Engineers

Information Leakage: Detection and Countermeasures

Giovanni Vigna

Reliable Software Group

Host-Based Intrusion Detection Systems

Security in Wireless Sensor Networks

Blaze D Waleski

Fulbright & Jaworski LLP

The Legal Implications of Information Security:

Regulatory Compliance and Liability

Jonathan Wallace

DeCoMo USA Labs

Anonymity and Identity on the Internet

University of North Carolina, Charlotte

PKCS (Public-Key Cryptography Standards)

John Warren

University of Texas, San Antonio

Groupware: Risks, Threats, and Vulnerabilities

in the Internet Age

James L Wayman

Biometric Basics and Biometric Authentication

Indiana University Southeast

Search Engines: Security, Privacy, and Ethical Issues

Paul L Witt

Texas Christian University

Internet Relay Chat

Avishai Wool

Tel Aviv University, Israel

Packet Filtering and Stateful Firewalls

Cheng-Zhong Xu

Mobile Code and Security

William A Zucker

Gadsby Hannah LLP

Corporate Spying: The Legal Aspects

Trang 24

xxii

Trang 25

The Handbook of Information Security is the first

com-prehensive examination of the core topics in the security

field The Handbook of Information Security, a 3-volume

reference work with 207 chapters and 3300+ pages, is a

comprehensive coverage of information, computer, and

network security

The primary audience is the libraries of 2-year and

4-year colleges and universities with computer science,

MIS, CIS, IT, IS, data processing, and business

depart-ments; public, private, and corporate libraries

through-out the world; and reference material for educators and

practitioners in the information and computer security

fields

The secondary audience is a variety of professionals

and a diverse group of academic and professional course

instructors

Among the industries expected to become increasinglydependent upon information and computer security and

active in understanding the many issues surrounding this

important and fast-growing field are: government,

mil-itary, education, library, health, medical, law

enforce-ment, accounting, legal, justice, manufacturing,

finan-cial services, insurance, communications, transportation,

aerospace, energy, biotechnology, retail, and utility

Each volume incorporates state-of-the-art, core mation, on computer security topics, practical applica-

infor-tions and coverage of the emerging issues in the

informa-tion security field

This definitive 3-volume handbook offers coverage ofboth established and cutting-edge theories and develop-

ments in information, computer, and network security

This handbook contains chapters by global academicand industry experts This handbook offers the following

features:

1) Each chapter follows a format including title and thor, outline, introduction, body, conclusion, glossary,cross-references, and references This format allowsthe reader to pick and choose various sections of achapter It also creates consistency throughout the en-tire series

au-2) The handbook has been written by more than 240 perts and reviewed by more than 1,000 academics andpractitioners from around the world These expertshave created a definitive compendium of both estab-lished and cutting-edge theories and applications

ex-3) Each chapter has been rigorously peer-reviewed Thisreview process assures accuracy and completeness

4) Each chapter provides extensive online and off-linereferences for additional readings, which will enablethe reader to learn more on topics of special interest

5) The handbook contains more than 1,000 illustrationsand tables that highlight complex topics for furtherunderstanding

6) Each chapter provides extensive cross-references,leading the reader to other chapters related to a par-ticular topic

7) The handbook contains more than 2,700 glossaryitems Many new terms and buzzwords are included

to provide a better understanding of concepts and plications

ap-8) The handbook contains a complete and sive table of contents and index

comprehen-9) The series emphasizes both technical as well as agerial, social, legal, and international issues in thefield This approach provides researchers, educators,students, and practitioners with a balanced perspec-tive and background information that will be help-ful when dealing with problems related to securityissues and measures and the design of a sound secu-rity system

man-10) The series has been developed based on the currentcore course materials in several leading universitiesaround the world and current practices in leadingcomputer, security, and networking corporations

We chose to concentrate on fields and supporting nologies that have widespread applications in the aca-demic and business worlds To develop this handbook,

tech-we carefully revietech-wed current academic research in thesecurity field from leading universities and research insti-tutions around the world

Computer and network security, information securityand privacy, management information systems, networkdesign and management, computer information systems(CIS), decision support systems (DSS), and electroniccommence curriculums, recommended by the Associa-tion of Information Technology Professionals (AITP) andthe Association for Computing Machinery (ACM) werecarefully investigated We also researched the currentpractices in the security field carried out by leading se-curity and IT corporations Our research helped us definethe boundaries and contents of this project

rInfrastructure for the Internet, Computer Networks, and

Secure Information Transfer

rStandards and Protocols for Secure Information

Transfer

rInformation Warfare

rSocial, Legal, and International Issues

xxiii

Trang 26

rPrevention: Keeping the Hackers and Crackers at Bay

rDetection, Recovery, Management, and Policy

Consid-erations

Although these topics are related, each addresses a

spe-cific concern within information security The chapters in

each category are also interrelated and complementary,

enabling readers to compare, contrast, and draw

conclu-sions that might not otherwise be possible

Though the entries have been arranged logically, the

light they shed knows no bounds The handbook provides

unmatched coverage of fundamental topics and issues for

successful design and implementation of a sound security

program Its chapters can serve as material for a wide

spectrum of courses such as:

Information and Network Security

Information Privacy

Social Engineering

Secure Financial Transactions

Information Warfare

Infrastructure for Secure Information Transfer

Standards and Protocols for Secure Information

TransferNetwork Design and Management

Client/Server Computing

E-commerce

Successful design and implementation of a sound security

program requires a thorough knowledge of several

tech-nologies, theories, and supporting disciplines Security

searchers and practitioners have had to consult many

re-sources to find answers Some of these rere-sources

concen-trate on technologies and infrastructures, some on social

and legal issues, and some on managerial concerns This

handbook provides all of this information in a

compre-hensive, three-volume set with a lively format

Key Concepts and Applications Related to

Information Security

Chapters in this group examine a broad range of topics

Theories, concepts, technologies, and applications that

expose either a user, manager, or an organization to

secu-rity and privacy issues and/or create such secusecu-rity and

pri-vacy concerns are discussed Careful attention is given to

those concepts and technologies that have widespread

ap-plications in business and academic environments These

areas include e-banking, e-communities, e-commerce,

e-education, and e-government

Infrastructure for the Internet, Computer

Networks, and Secure Information Transfer

Chapters in this group concentrate on the infrastructure,

popular network types, key technologies, and principles

for secure information transfer Different types of munications media are discussed followed by a review of

com-a vcom-ariety of networks including LANs, MANs, WANs, bile, and cellular networks This group of chapters alsodiscusses important architectures for secure informationtransfers including TCP/IP, the Internet, peer-to-peer, andclient/server computing

mo-Standards and Protocols for Secure Information Transfer

Chapters in this group discuss major protocols and dards in the security field This topic includes importantprotocols for online transactions, e-mail protocols, Inter-net protocols, IPsec, and standards and protocols for wire-less networks emphasizing 802.11

stan-Information Warfare

This group of chapters examines the growing field ofinformation warfare Important laws within the UnitedStates criminal justice system, as they relate to cybercrimeand cyberterrorism, are discussed Other chapters in thisgroup discuss cybercrime, cyberfraud, cyber stalking,wireless information warfare, electronic attacks and pro-tection, and the fundamentals of information assurance

Social, Legal, and International Issues

Chapters in this group explore social, legal, and tional issues relating to information privacy and computersecurity Digital identity, identity theft, censorship, anddifferent types of computer criminals are also explored.The chapters in this group also explain patent, trademark,and copyright issues and offer guidelines for protectingintellectual properties

interna-Foundations of Information, Computer, and Network Security

These chapters cover four different but complementaryareas including encryption, forensic computing, operat-ing systems and the common criteria and the principlesfor improving the security assurance

Threats and Vulnerabilities to Information and Computing Infrastructures

The chapters in this group investigate major threats

to, and vulnerabilities of, information and computinginfrastructures in wired and wireless environments Thechapters specifically discuss intentional, unintentional,controllable, partially controllable, uncontrollable, phys-ical, software and hardware threats and vulnerabilities

Prevention: Keeping the Hackers and Crackers at Bay

The chapters in this group present several concepts,tools, techniques, and technologies that help to protectinformation, keep networks secure, and keep the hack-ers and computer criminals at bay Some of the topicsdiscussed include physical security measures; measures

Trang 27

T OPIC C ATEGORIES xxv

for protecting client-side, server-side, database, and

med-ical records; different types of authentication techniques;

and preventing security threats to e-commerce and e-mail

transactions

Detection, Recovery, Management, and

Policy Considerations

Chapters in this group discuss concepts, tools, and

tech-niques for detection of security breaches, offer techtech-niques

and guidelines for recovery, and explain principles for

managing a network environment Some of the topics

highlighted in this group include intrusion detection,

contingency planning, risk management, auditing, and

guidelines for effective security management and policy

implementation

Acknowledgments

Many specialists have helped to make the handbook a

re-source for experienced and not-so-experienced readers It

is to these contributors that I am especially grateful This

remarkable collection of scholars and practitioners has

distilled their knowledge into a fascinating and

enlight-ening one-stop knowledge base in information, computer,

and network security that “talks” to readers This has been

a massive effort, as well as a most rewarding experience

So many people have played a role, it is difficult to know

where to begin

I would like to thank the members of the editorial boardfor participating in the project and for their expert advice

on selection of topics, recommendations of authors, and

review of the materials Many thanks to the more than

1,000 reviewers who provided their advice on improvingthe coverage, accuracy, and comprehensiveness of thesematerials

I thank my senior editor, Matt Holt, who initiated theidea of the handbook Through a dozen drafts and manyreviews, the project got off the ground and then was man-aged flawlessly by Matt and his professional team Manythanks to Matt and his team for keeping the project fo-cused and maintaining its lively coverage

Tamara Hummel, editorial coordinator, assisted thecontributing authors and me during the initial phases ofdevelopment I am grateful for all her support When itcame time for the production phase, the superb Wileyproduction team took over Particularly, I want to thankDeborah Schindlar, senior production editor I am gratefulfor all her hard work I thank Michelle Patterson, our mar-keting manager, for her impressive marketing campaignlaunched on behalf of the handbook

Last, but not least, I want to thank my wonderfulwife, Nooshin, and my two children, Mohsen and Mor-vareed, for being so patient during this venture They pro-vided a pleasant environment that expedited the comple-tion of this project Mohsen and Morvareed assisted me

in sending out thousands of e-mail messages to authorsand reviewers Nooshin was a great help in designingand maintaining the authors’ and reviewers’ databases.Their efforts are greatly appreciated Also, my two sis-ters, Azam and Akram, provided moral support through-out my life To this family, any expression of thanks isinsufficient

Hossein BidgoliCalifornia State University, Bakersfield

Trang 28

Guide to The Handbook of Information Security

The Handbook of Information Security is a comprehensive

coverage of the relatively new and very important field of

information, computer, and network security This

refer-ence work consists of three separate volumes and 207

dif-ferent chapters on various aspects of this field Each

chap-ter in the handbook provides a comprehensive overview of

the selected topic, intended to inform a broad spectrum of

readers, ranging from computer and security

profession-als and academicians to students to the general business

community

This guide is provided to help the reader easily locate

information throughout The Handbook of Information

Se-curity It explains how the information within it can be

located

Organization

This is organized for maximum ease of use, with the

chap-ters arranged logically in three volumes While one can

read individual volumes (or articles) one will get the most

out of the handbook by becoming conversant with all

three volumes

Table of Contents

A complete table of contents of the entire handbook

ap-pears in the front of each volume This list of chapter titles

represents topics that have been carefully selected by the

editor-in-chief, Dr Hossein Bidgoli, and his colleagues on

the editorial board

Index

A subject index for each individual volume is located at

the end of each volume

Chapters

The author’s name and affiliation are displayed at the

be-ginning of the chapter

All chapters in the handbook are organized in the same

Introduction

Each chapter begins with an introduction that defines thetopic under discussion and summarized the chapter, inorder to give the reader a general idea of what is to come

high-Glossary

The glossary contains terms that are important to an derstanding of the chapter and that may be unfamiliar tothe reader Each term is defined in the context of the par-ticular chapter in which it is used Thus the same termmay be defined in two or more chapters with the detail

un-of the definition varying slightly from one chapter to other The handbook includes approximately 2,700 glos-sary terms For example, the chapter “Internet Basics” in-cludes the following glossary entries:

an-Extranet A secure network that uses the Internet and Web

technology to connect two or more intranets of trustedbusiness partners, enabling business-to-business,business-to-consumer, consumer-to-consumer, andconsumer-to-business communications

Intranet A network within the organization that uses

Web technologies (TCP/IP, HTTP, FTP, SMTP, HTML,XML, and its variations) for collecting, storing,and disseminating useful information throughout theorganization

Cross-References

All chapters have cross-references to other chapters thatcontain further information on the same topic They

xxvi

Trang 29

G UIDE TO T HE H ANDBOOK OF I NFORMATION S ECURITY xxvii

appear at the end of the chapter, preceding the references

The cross-references indicate related chapters that can

be consulted for further information on the same topic

The handbook contains more than 1,400 cross-references

in all For example, the chapter “Computer Viruses and

Worms” has the following cross references:

Hackers, Crackers and Computer Criminals, HoaxViruses and Virus Alerts, Hostile Java Applets, Spyware,

Trojan Horse Programs

References

The references in this handbook are for the benefit of thereader, to provide references for further research on thegiven topic Review articles and research papers that areimportant to an understanding of the topic are also listed.The references typically consist of a dozen to two dozenentries, and do not include all material consulted by theauthor in preparing the chapter

Trang 30

xxviii

Trang 31

PART 1 Information Warfare

1

Trang 32

JWBS001B-71.tex WL041/Bidgoli WL041-Bidgoli.cls October 17, 2005 12:8 Char Count= 0

2

Trang 33

Cybercrime and the U.S Criminal Justice System

Susan W Brenner, University of Dayton School of Law

Relationship between State and Federal Criminal

Federal Cybercrime Law 11State Cybercrime Law 12

Cybercrime, which is essentially the use of computer

tech-nology in the commission of criminal activity, presents

many challenges for the U.S legal system On the one

hand, state and federal law adequately criminalizes most

of the basic cybercrime offenses; on the other hand, there

is substantial disagreement as to the penalties that are

ap-propriate for those who commit these offenses The

dis-agreement over penalties is exacerbated by the fact that

many offenders are juveniles; the federal system,

espe-cially, is not equipped to deal with juveniles Charging

decisions can be difficult because it is not easy to parse

cybercrime into offenses: Is the dissemination of a virus

that damages a million computers one crime or a million

crimes? As is explained below, these are only a few of the

ways in which cybercrime challenges the basic

assump-tions that structured traditional criminal law

DIFFERENCES FROM CIVIL

JUSTICE SYSTEM

The criminal justice system in the United States—as

elsewhere—differs from the civil justice system in several

important ways One difference is substantive: the goal of

the civil justice system is to provide redress for accidental

or conventional injuries or losses one “person,” which can

be an individual or a corporate entity, has suffered as the

result of another’s actions or failure to act (LaFave, 2003)

The goal of the criminal justice system, on the other hand,

is to allow the state—acting on behalf of the people in a

specific society—to inflict punishment on those who

in-flict deliberate, serious injuries upon others Technically,

therefore, in the criminal justice system, the state is the

injured party, and criminal proceedings are brought in

the name of the appropriate government, which will be

federal, state, or local (LaFave, 2003)

Another difference is procedural: the U.S Constitutionsets limits on what law enforcement officers can do when

investigating crimes such as hacking or cyberfraud State

and federal officers must tender the Miranda warnings to

anyone whom they take into custody for the purposes of

interrogation (LaFave, Israel, & King, 1999) The FourthAmendment requires that they either obtain a search war-rant or invoke a valid exception to the warrant require-ment to search for and seize evidence of a cybercrime;

so, if officers believe child pornography is located in asuspect’s computer in his or her bedroom, they must per-suade a magistrate to issue a warrant allowing them tosearch the computer or convince the suspect to consent

to such a search (consent being an exception to the rant requirement) (LaFave et al., 1999)

war-There are other procedural differences that distinguishcriminal trials from civil trials: In a criminal trial, the pros-ecution must prove its case “beyond a reasonable doubt,”which is a far more demanding standard than the “pre-ponderance of the evidence” standard used in civil trials(LaFave et al., 1999) If the civil standard were used in

a hacking prosecution, the government would only have

to prove it was “more likely than not” that the defendantengaged in hacking; under the criminal standard, the gov-ernment must prove beyond a reasonable doubt that thecrime of hacking was committed and that it was commit-ted by the defendant (LaFave et al., 1999) This higherstandard protects those who are accused of crimes andthereby helps to avoid wrongful convictions; other rulesthat work to the same end are the presumption that a de-fendant is innocent and an indigent defendant’s right toappointed counsel (LaFave et al., 1999) The size of crim-inal juries also contributes to this goal; in the federal sys-tem and in most states, 12 jurors are required in criminaltrials (LaFave et al., 1999) Civil trials often involve fewerjurors, frequently as few as six (LaFave et al., 1999) Thesize of the jury is important because studies have shownlarger juries are more likely to result in fair deliberations(LaFave et al., 1999)

BASIC INSTITUTIONAL STRUCTURE

Law enforcement in the United States takes place atthree distinct levels: federal, state, and local government(LaFave et al., 1999) At the federal level, the FederalBureau of Investigation and the Secret Service actively

3

Trang 34

C YBERCRIME AND THE U.S C RIMINAL J USTICE S YSTEM

4

pursue cybercrime investigations, but their efforts

ac-count for only a fraction of the total number of

investi-gations; in the United States, state and federal law

en-forcement have traditionally been primarily responsible

for pursuing criminal cases (LaFave et al., 1999) As a

result, U.S cybercrime laws can overlap: The federal

sys-tem and all of the states have laws that criminalize

hack-ing, cyberfraud, and other common cybercrimes (Ditzion,

Geddes, & Rhodes, 2003) The default assumptions are

that (a) state and local authorities have jurisdiction to

prosecute and (b) federal authorities must be able to bring

a hacking or other cybercrime case within a federal

juris-dictional predicate to be able to prosecute (LaFave, 2003)

The most common federal jurisdictional predicate used in

cybercrime cases is an effect on interstate or foreign

com-merce; this is the predicate used in the general federal

cybercrime statute, 18 U.S Code§1030 (Ditzion, Geddes,

& Rhodes, 2003) So, to prosecute someone for hacking in

violation of§1030, federal prosecutors have to show that

the hacking had an impact on interstate or foreign

com-merce, which is usually not difficult to do (American Bar

Association Task Force, 1998)

When a cybercrime occurs, the investigation is

un-dertaken by local, state, or federal law enforcement

offi-cers who may work in conjunction with a prosecutor and

who often work in conjunction with computer forensic

and other experts, such as forensic psychologists (LaFave

et al., 1999) Given the complexity of cybercrime cases,

these investigations are increasingly undertaken by task

forces in which local, state, and federal officers

collabo-rate with private investigators to pursue a cybercriminal

(Miami Electronic Crimes Task Force, 2003) Indeed, one

of the distinguishing aspects of cybercrime cases is the

es-sential involvement of the private sector: cybercrimes are

often committed against businesses, which must decide if

they want to report the matter to the authorities or handle

it in-house There are disincentives for reporting a

cyber-attack; aside from anything else, news that a company has

been victimized by a cyberattacker can undermine

confi-dence in the business and in its ability to protect client

or customer information (Brenner & Schwerha, 2002)

If a business is attacked and decides to report the

mat-ter to the authorities, it will have to decide if it wants

to contact federal, state, or local authorities (Brenner &

Schwerha, 2002) There are certain advantages to seeking

federal prosecution; federal agencies often have more

re-sources and expertise in dealing with computer crime, and

they are not hampered by the jurisdictional impediments

that confront state authorities A federal search warrant,

for example, is enforceable anywhere in the United States;

a state search warrant, a New York warrant, say, is

en-forceable only within the state of New York

Because cybercrime cases can be difficult to investigate

and prosecute, there is an emerging emphasis on avoiding

the need for both by preventing cybercrime Prevention is

a major focus of the Secret Service’s Electronic Crime Task

Forces and the Federal Bureau of Investigation’s Infragard

program Both initiatives bring together representatives

from law enforcement, the private sector, and academia to

share information and resources, thereby facilitating the

prevention of cybercrime and the investigation of

com-pleted cybercrimes

Prosecutor

The central figure in any cybercrime case is the prosecutor

In the U.S justice system, prosecutors occupy a uniquerole; they serve as advocates for the state and in that senseplay a role analogous to that of the defense lawyer As ad-vocates, defense lawyers are obliged to use every tacticaladvantage permitted under the law to obtain their client’sacquittal, even if doing so keeps the jury from the truth(LaFave et al., 1999) Prosecutors are held to a higher stan-dard; their duty is to ensure justice is done, not merely

to win a criminal case (LaFave et al., 1999) But when astate or federal prosecutor does take a case to trial, his orher goals will generally be to obtain a conviction (LaFave

et al., 1999)

Because crimes are considered a wrong against thegovernment, prosecutions are undertaken in the name ofthe government, whether federal, state, or local, and vic-tims consequently play a minor role (LaFave et al., 1999).Victims typically have little say in the charging or plea bar-gaining processes; their role is usually limited to that ofwitness (LaFave et al., 1999) Prosecutors control charg-ing and plea bargaining; they have wide discretion in de-ciding (a) whether someone will be prosecuted and (b) ifsomeone is to be prosecuted, what charges they will face(LaFave et al., 1999) In a hacking case, for instance, theprosecutor might decide not to prosecute the offender be-cause he is a juvenile This is particularly likely to occur

in the federal system, which is not set up to deal withjuvenile offenders (Esbenshade, 2002–2003) As a result,federal prosecutors tend to concentrate on adult offendersand turn juveniles over to the juvenile court of the appro-priate state, pursuant to the Federal Juvenile DelinquencyAct (Esbenshade, 2002–2003)

Another large class of cybercrime cases in the UnitedStates involves intellectual property (U.S Department

of Justice Computer Crime and Intellectual PropertySection, 2001): “Legal regimes have created enforceablerights in certain intangibles that have become familiar

as intellectual property, including copyrights, trademarks,patents, and trade secrets” (U.S Department of JusticeComputer Crime and Intellectual Property Section, 2001)

At the federal level, various statutes are used to ecute the unlawful appropriation of intellectual prop-erty: 18 U.S Code§2320 makes it a crime to counterfeit

pros-trademarks 18 U.S Code§§1831 and §§1832 make the

theft of trade secrets a federal crime And copyright fringement is criminalized by 17 U.S Code§506(a) and

in-18 U.S Code§2319 Patent infringement “is not generally

a criminal violation” (U.S Department of Justice puter Crime and Intellectual Property Section, 2001) Fed-eral law preempts state law governing copyright viola-tions, so prosecutions can be brought only at the federallevel (Nicholson et al., 2000) Federal law does not pre-empt state law governing trademark violations, except in-sofar as the state and federal statutory provisions conflict(Kahn, 2004)

Com-In deciding whether to prosecute intellectual erty crimes, such as criminal copyright infringement, fed-eral prosecutors must consider the strength of their case,the person’s culpability in connection with the crime(s),the person’s history (if any) of prior criminal activity,

Trang 35

prop-B ASIC I NSTITUTIONAL S TRUCTURE 5

current federal law enforcement priorities, and the

ex-tent to which such a prosecution would deter others from

engaging in similar conduct (U.S Department of Justice

Computer Crime and Intellectual Property Section, 2001)

These factors, and perhaps most notably the federal

inter-est in protecting U.S.-based intellectual property rights,

have prompted federal prosecutions of those who use the

Internet to supply “warez,” that is, pirated copies of

soft-ware (U.S Department of Justice Computer Crime and

Intellectual Property Section, 2001) A study of federal

cybercrime prosecutions found that in 2001 the

Depart-ment of Justice declined to prosecute in 496 of 631

re-ferred cases; 135 cases were prosecuted, resulting in 107

convictions and 28 dismissals or acquittals on all charges

(National Association of Criminal Defense Lawyers,

Elec-tronic Frontier Foundation & Sentencing Project, 2003)

The primary reason given for declining prosecution was

lack of evidence or inadmissible evidence (National

Asso-ciation of Criminal Defense Lawyers, Electronic Frontier

Foundation & Sentencing Project, 2003) The next most

commonly cited reasons were (a) that the person would

be prosecuted at the state level and (b) the lack of a

fed-eral interest in prosecuting (National Association of

Crim-inal Defense Lawyers, Electronic Frontier Foundation &

Sentencing Project, 2003)

Even when prosecutors decide to charge someone, thedefense attorney may be able to arrange a plea bargain: in

1995, hacker Kevin Mitnick pled guilty to 1 of 23 counts

brought against him in a North Carolina federal

prose-cution (Goldman, 1995) By pleading guilty, he was

guar-anteed a sentence of no more than 8 months and avoided

prosecution on the remaining 22 counts (Goldman, 1995)

Plea bargains offer defendants the opportunity to accept

a lesser penalty in return for avoiding at least the

possi-bility of a greater penalty, but they also offer certain

ad-vantages for prosecutors Plea bargains let prosecutors

re-solve cases without having to go to trial, which alleviates

the burden on a criminal justice system that is swamped

with cybercrime and real-world crime cases; plea

bar-gains also let prosecutors trade lesser sentences for a

de-fendant’s cooperation in prosecuting other, presumably

more culpable, offenders The potential for cooperation is

one of the factors federal prosecutors consider in

decid-ing whether to brdecid-ing charges and whether to plea bargain

charges that have already been brought (U.S Department

of Justice Computer Crime and Intellectual Property

Sec-tion, 2001)

As noted, law enforcement in the United States erates on three levels: local, state, and federal This is

also true for prosecutors Local prosecutors generally

op-erate at the county or parish level; there is typically an

elected prosecutor who is usually known either as the

county prosecutor or the district attorney (LaFave et al.,

1999) He or she functions with the aid of a number of

assistants, who are known as assistant district attorneys,

deputy county prosecutors, or similar titles (LaFave et al.,

1999) Moving up a tier, each state has an attorney

gen-eral whose jurisdiction varies from state to state: in some

states, attorney generals are authorized only to prosecute

certain, specialized crimes such as antitrust or organized

crime cases; in other states, attorney generals have much

more limited jurisdiction to prosecute and may be ited to substituting when a local prosecutor is disquali-fied (LaFave et al., 1999) Like local prosecutors, attorneygenerals function with the aid of assistants, who are usu-ally known as deputy attorney generals or assistant attor-ney generals Many state attorney general’s offices haveestablished cybercrime units and the National Associa-tion of Attorneys General has its own cybercrime initiative(National Association of Attorneys General—ComputerCrime, 2003) Moving up to the third tier, the federal jus-tice system is headed by an attorney general, who alsofunctions with the aid of assistants and deputies (LaFave

lim-et al., 1999) The attorney general also heads up a wide organization of United States attorneys; a UnitedStates attorney is appointed for every federal judicial dis-trict in the United States; they function in a fashion anal-ogous to county prosecutors; that is, they deal with fed-eral crimes committed in a specified geographical area(LaFave et al., 1999) The Department of Justice, headed

nation-by the attorney general, also deals with federal crime on amore global level; the department has a specialized unit—the Computer Crime and Intellectual Property Section—which deals with cybercrime as a general phenomenon(Ditzion, Geddes, & Rhodes, 2003)

After a prosecutor has taken a case to trial and tained a conviction or entered into a plea bargain with

ob-a defendob-ant, the next step in the process is sentencing(LaFave et al., 1999) In all but a few U.S jurisdictions,which allow for jury sentencing even in noncapital cases,the determination and imposition of an appropriate sen-tence are a matter for the court (LaFave et al., 1999) TheU.S system uses four types of sanctions: financial (fines,restitution), community release (probation, unsupervisedrelease, house arrest), incarceration in a jail (for shortersentences) or a prison (for longer sentences), and capi-tal punishment (for murder) (LaFave et al., 1999) Courtscan combine these sanctions; in one cybercrime case, forexample, the court sentenced the defendant to 3 years’probation, a $40,000 fine, and the payment of $20,000

in restitution (U.S v Hicks, 1995) In the federal systemand a number of states, sentences are determinate; that

is, the offender serves the entire sentence imposed by thecourt (except for “good time” credit) (LaFave et al., 1999).The other states use indeterminate sentencing, in whichthe court sets a maximum period and a minimum pe-riod of incarceration and the state parole board decideshow much time the offender will exactly serve (LaFave

et al., 1999) Both systems are increasingly using ing guidelines, which are standards that limit the judge’sdiscretion in imposing sentence (LaFave et al., 1999) Un-til recently, cybercrime offenders often received sentences

sentenc-of probation only, or, at most, a short period sentenc-of tion (Beauprez, 2003) In November 2003, new sentencingguidelines went into effect in the federal system that willincrease punishments in at least some cybercrime cases(Beauprez, 2003)

incarcera-Defense Attorney

The defense attorney’s role is to ensure that no tion is obtained unless (a) the prosecution proves its case

Trang 36

convic-JWBS001B-71.tex WL041/Bidgoli WL041-Bidgoli.cls October 17, 2005 12:8 Char Count= 0

6

beyond a reasonable doubt or (b) the defendant accepts a

plea bargain that is advantageous for him or her (LaFave

et al., 1999) As noted, when charges have been brought,

it is defense counsel’s task to utilize every tactical

advan-tage at his or her disposal to obtain the best outcome for

the client (LaFave et al., 1999) Unlike the prosecutor, the

defense attorney’s advocacy is not constrained by

exter-nal principles; in our adversarial system of justice,

de-fense counsel is charged with pursuing the client’s best

interests without regard to other concerns (LaFave et al.,

1999) That includes ensuring that the trial or the plea

bargaining process is conducted in accordance with

con-stitutional and other legal requirements; for that reason,

ineffective assistance of defense counsel is a basis for

set-ting aside a conviction (LaFave et al., 1999) But although

defense counsel must represent his or her client zealously

and loyally, defense attorneys, like prosecutors, are

ethi-cally obligated not to misrepresent matters of fact or law

to the court, not to suborn perjury by one’s client, and

not to destroy, alter, or conceal evidence (American Bar

Association, 2003)

The Sixth Amendment creates a right to counsel

for those charged with the commission of crimes; the

Supreme Court has held that this right attaches to all

“critical” stages of a prosecution, such as the

arraign-ment, plea negotiations, and trial (LaFave et al., 1999)

In both the state and federal systems, defendants are

rep-resented either by privately retained attorneys or by

attor-neys provided by the government (LaFave et al., 1999) If

a defendant cannot afford to retain private counsel, the

court will arrange for appointed counsel to represent him

or her (LaFave et al., 1999) States use three systems to

accomplish this: in most counties, indigents are

repre-sented by public defenders—attorneys whom the county

employs to represent those who cannot afford private

counsel (LaFave et al., 1999) The second most commonly

used system relies on private attorneys whom judges

ap-point to represent indigents; these private attorneys are

paid at a rate determined by the local government (LaFave

et al., 1999) Finally, a few counties use a system in which

a private law firm or a bar association contracts with the

county to provide representation for indigents (LaFave

et al., 1999) In the federal system, federal public

defend-ers represent indigents in a number of judicial districts,

whereas the others rely on court-appointed private

coun-sel (LaFave et al., 1999)

The defense of a cybercrime case is a difficult matter,

because it requires special expertise as to substantive law

[i.e., the offense(s) charged], procedural law (i.e., the

le-gality of the tactics employed in the investigation), and

the intricacies of computer technology So far, there

ap-pears to be a serious scarcity of attorneys who

special-ize in cybercrime cases, no doubt because such cases are

still relatively rare, considered in relation to the other

types of criminal cases being brought To date, many of

those charged with cybercrime have relied on privately

retained counsel, perhaps because hackers and others

volved with computer technology are less likely to be

in-digent than, say, those charged with drug offenses There

have, however, been exceptions: Adrian Lamo, who

be-came famous as the “homeless hacker,” relied on a public

defender when he was prosecuted federally for hacking

into systems, including the New York Times’ computer

sys-tem (Reuters Wired News, 2003)

to crimes for which one can serve less than 6 months

in prison, the right to jury trial does not attach unlessthe presence of additional statutory or regulatory penal-ties indicates that the legislature considered the offense a

“serious” crime (Right to Jury Trial, 2003)

Usually, the jury in a criminal trial consists of 12 jurors,but the Supreme Court has held that 6 jurors are enough

to satisfy the Sixth Amendment (Right to Jury Trial, 2003).Court rules, such as Rule 23 of the Federal Rules of Crim-inal Procedure, require the impaneling of 12 jurors in fed-eral criminal trials, absent a written waiver executed bythe parties and approved by the court (Right to Jury Trial,2003) The Supreme Court has consistently held that ju-rors in federal criminal trials must return a unanimousverdict (Right to Jury Trial, 2003) As for state criminaltrials, the jury must be unanimous if it consists of only

6 jurors; if the jury consists of 12 jurors, they can return

a nonunanimous verdict (Right to Jury Trial, 2003) ditionally, jurors were required to be purely passive spec-tators at a trial; they were not allowed to ask questions

Tra-or otherwise participate in the proceedings (Hans, 2002).More and more, however, jurors are being allowed to askquestions, take notes, and discuss the case with each otherduring the trial (Hans, 2002)

A jury trial is a defendant’s constitutional right, but

it may or may not be the best choice, depending on thenature of the case If the defense attorney believes thecase is likely to inflame the passions of the jury againsthis or her client, the best course may be to ask for a benchtrial This can, for example, be an advisable tactic in achild pornography case: even though there may be validevidentiary and/or legal reasons to acquit the accused, thejurors may be so disturbed by the images the prosecutionpresents that they will ignore those reasons and convict,leaving the matter to be appealed In such an instance, thewiser course may well be for the defendant to waive hisright to a jury trial and have the case tried by the court.The same can be true for crimes involving difficult legaland technical issues, such as actions under the Digital

Millennium Copyright Act (Universal City Studios, Inc v.

Corley, 2001).

A defendant can waive his or her right to a jury trial

by (a) obtaining the court’s approval and the ment’s consent and (b) executing a written waiver that

govern-is knowing, voluntary, and intelligent (Right to Jury Trial,2003) The government’s consent is required because theSupreme Court has held that there is no constitutionalright to a bench trial (Right to Jury Trial, 2003) Because

Trang 37

B ASIC I NSTITUTIONAL S TRUCTURE 7

there is no constitutional right to a nonjury trial, the

pros-ecution can, in effect, veto a defendant’s wish to have his

or her case heard by the court instead of a jury; all that

is required is for the prosecution to refuse to consent to a

bench trial (Right to Jury Trial, 2003)

Once a criminal case has been tried to its conclusion,the defendant cannot be tried again for the crimes at is-

sue in that proceeding, as the Fifth Amendment declares

that one cannot be twice “put in jeopardy” for the “same

offence” (LaFave et al., 1999) The double jeopardy clause

not only prevents the retrial of cases that have produced

a conviction or acquittal; it can also prevent retrials after

a case has been begun and is then terminated before the

matter goes to the jury (LaFave et al., 1999) The basic

rule is that “jeopardy” attaches (a) after the first witness

has been sworn in a bench trial and (b) after the jurors

have been sworn in for a jury trial (LaFave et al., 1999)

The protections of the double jeopardy clause are ject to certain exceptions: for one thing, the government

sub-may be able to reprosecute a defendant even when a trial

has been dismissed after jeopardy has attached; in certain

circumstances, a retrial can occur after a mistrial has been

declared (LaFave et al., 1999) For another, the protection

only applies to a second prosecution by the same

govern-ment; consequently, it is not a violation of double jeopardy

for a state to prosecute someone for crimes that were at

issue in a preceding federal prosecution that produced a

judgment of conviction or acquittal (LaFave et al., 1999)

Perhaps the most famous instance of this, in recent years,

is the state prosecution Oklahoma has brought against

Terry Nichols for his role in the bombing of the Oklahoma

City Federal Building; Nichols, of course, has already been

prosecuted and convicted in a federal proceeding arising

out of the same event (Romano, 2004)

Another important constitutional protection is theSixth Amendment right to speedy trial The Supreme

Court has explained that this right is essential to protect at

least three basic demands of justice: “(1) to prevent undue

and oppressive incarceration prior to trial, (2) to minimize

anxiety and concern accompanying public accusation and

(3) to limit the possibilities that long delay will impair the

ability of an accused to defend himself” (Smith v Hooey,

1969) Indeed, this right is considered so important that

the Sixth Amendment guarantee has been supplemented

by statutory and rule-based protections in both the state

and federal systems (LaFave et al., 1999)

Basic Defenses

As to defending himself or herself, the substantive

crimi-nal law provides an array of theories defendants can use to

argue that they should be acquitted of the charges brought

against them Analytically, these defenses fall into two

cat-egories: (1) failure of proof defenses and (2) affirmative

defenses (LaFave, 2003)

Failure of proof defenses are not “true” defenses; theyare merely a way of attacking the prosecution’s case As

one scholar explains, a “failure of proof defense is one

in which the defendant has introduced evidence at his

criminal trial showing that some essential element of the

crime charged has not been proved beyond a reasonable

doubt” (LaFave, 2003) Because criminal liability requires

a voluntary act (actus reus) done with the appropriate mental state (mens rea), defendants often argue that they

cannot be held guilty because they either were not ing voluntarily or, if they were acting voluntarily, did notpossess the mental state required for the offense (LaFave,2003) Assume, for example, that an employee of a com-pany is charged with hacking (i.e., with unauthorized in-trusion into an area of the company’s computer system);the premise of the charges is that although the employeehad authorized access to part of the company’s computersystem, he exceeded the scope of that authorized accessand explored parts of the system that he was not legiti-

act-mately entitled to access (United States v Czubinski, 1997).

Assume, further, that the charge against the employee

is that he “knowingly” gained “unauthorized access” toparts of his employer’s computer system The defendantcan mount a failure of proof defense by claiming that, al-though he did exceed the scope of his authorized access

to the computer system, he did not do so “knowingly”;

he could argue, for example, that he believed he had fullaccess to the entire system because no security measuresprevented his exploring parts of the system beyond those

he used in the course of his everyday tasks If the employerdid not have policies that made it clear that employeeswere not to exceed a specifically defined scope of access tothe computer system, this failure of proof defense mightwell work Predicating a failure of proof defense on thetheory that one was not acting voluntarily at the time theoffense was committed is much more difficult when com-puter crimes are involved: generally speaking, claims thatone was not acting voluntarily require the defendant toshow that he or she was in a state of unconsciousness atthe time the offense was committed; such claims rest, forexample, on assertions that the defendant was sleepwalk-ing, suffering from an epileptic seizure, or in a fugue stateinduced, say, by brain trauma or a reaction to medication(LaFave, 2003) Claims such as these can be credible whenthe offense involves simple acts, such as driving a car; theyare hardly likely to be credible when the offense involvescomplex activity requiring the application of specializedtechnical knowledge and skills

Unlike failure of proof defenses, affirmative defenses

do not involve attacking the prosecution’s ability to provethe elements of its case (LaFave, 2003) One who asserts

an affirmative defense is, in effect, saying “yes, but ”;that is, the defendant is saying, in effect, “Yes, I commit-ted the crime but there are valid reasons why I shouldnot be held liable for doing so.” The basic affirmative de-fenses are (a) insanity, (b) self-defense, (c) defense of oth-ers, (d) defense of property, (e) duress, and (f) choice ofevils (LaFave, 2003) Insanity and duress are “excuse” de-fenses; one who asserts these affirmative defenses is, inessence, saying “Yes, I committed the crime but I shouldnot be held liable” because (a) I was insane and thereforedid not know right from wrong or (b) I was forced to com-mit the crime by threats or violence from another person(LaFave, 2003) The other four are “justification” defenses;one who asserts these affirmative defenses is, in essence,saying “Yes, I committed the crime but I did the right thing

in doing so” because I acted to protect myself, to tect someone else, to protect property or to avoid someharm greater than that resulting from the commission

Trang 38

pro-JWBS001B-71.tex WL041/Bidgoli WL041-Bidgoli.cls October 17, 2005 12:8 Char Count= 0

8

of this crime (LaFave, 2003) Although the prosecution

bears the burden of proving every element of the crime

beyond a reasonable doubt, the defendant bears the

bur-den of producing evibur-dence that is sufficient to raise a

cog-nizable claim that the affirmative defense applies; a

defen-dant must, for example, produce evidence that supports

his or her claim of having acted in self-defense (LaFave,

2003)

Generally speaking, these traditional affirmative

de-fenses tend to have little applicability in cybercrime

pros-ecutions One who seeks to raise an insanity defense will

encounter some of the same logical obstacles as a

defen-dant who tries to argue that he or she was not acting

vol-untarily at the time the crime was committed; although it

might be possible to show, say, that the defendant was

act-ing under the influence of command hallucinations when

he or she hacked into NASA, both juries and judges are

likely to be skeptical of such claims when the charges

in-volve crimes the commission of which necessarily entails

a course of structured, sequenced conduct The same is

true of duress: to qualify for the duress defense, a

defen-dant must show that he or she committed the crime(s) at

issue because he was forced to do so by another person,

who threatened him with death or serious bodily injury

if he did not comply with that person’s demands (LaFave,

2003) It is, of course, quite possible that someone could

use force or the threat of force to coerce a person with

computer skills into hacking into a system, releasing a

virus or otherwise violating state or federal cybercrime

laws The likelihood of this happening seems, however,

rather remote; the duress defense is often raised when

one participant in criminal activity (A) is coerced by

an-other participant in that activity (B) to “go further” than

A had intended or desires (LaFave, 2003) It is

exceed-ingly rare for the defense to be raised in an instance of

“stranger danger” (i.e., when a stranger forces an

other-wise law-abiding citizen to commit a crime by using or

threatening force) Because computer crimes tend, so far,

to be committed by those who have no history of violent

criminal activity, it is unlikely that the duress defense will

be successfully asserted in cybercrime prosecutions for

the foreseeable future

It may be somewhat easier to raise a justification

fense Self-defense requires a use of “force” that the

de-fending party deemed was necessary to protect himself

or herself from another’s use of force, either deadly or

nondeadly (LaFave, 2003) Historically, “force” has meant

physical force, but there is no reason why we could not

expand the concept to encompass “virtual force” (i.e., an

assault using computer technology) Even if we did so,

however, the assault would have to threaten a human

be-ing with death or serious physical injury for the

defend-ing party to be able to utilize self-defense as the

justifica-tion for retaliative acjustifica-tions; an attack focusing solely on a

computer system would not suffice as the basis for

invok-ing this defense (LaFave, 2003) In 2001, a Chinese man

claimed to have hacked into a computer system in

self-defense: he said he hacked into the other system because

he thought the operators of that system had attacked his

computer (Ying-Cheng, 2001) Even if this gentleman had

been correct in that belief, he would not, under U.S law,

have been able to claim self-defense because the attack

was not a personal attack (i.e., was not directed at ing physical harm to him) (LaFave, 2003)

caus-The same would be true if this gentleman had tried

to assert the related affirmative defense of defense ofothers; defense of others requires that one has actedbecause such action was necessary to prevent anotherperson or other persons from death or physical injury(LaFave, 2003) It is of course conceivable that such adefense could be asserted successfully in the context of acyberassault: assume, for instance, that during the dead ofwinter a cyberterrorist is in the process of attacking a com-puter system that controls electrical power to a midwest-ern city; if the cyberterrorist succeeds in taking over thesystem and shutting down power to the city, people will bewithout light, heat, and other services Many will die fromexposure; others will die from panic, from their inabil-ity to gain assistance, from emergency services, and forother reasons A computer technician discovers that theattack is in progress and knows it will succeed before hewould have time to contact the authorities and secure of-ficial intervention; if this technician hacks into the cyber-terrorist’s computer or otherwise takes defensive mea-sures to prevent the attack, he should be able to assert

a claim of self-defense in the improbable instance he ischarged with hacking into the computer which is the cy-berterrorist’s target In this example, the computer tech-nician is using a type of “force,” virtual force, to preventinjury to other persons and is, therefore, justified in at-tacking the cyberterrorist’s computer

This brings us to defense of property; like self-defenseand defense of others, defense of property has tradition-ally required that one use physical force In this instance,the force is used to preserve one’s possession of, or theintegrity of, real or personal property (LaFave, 2003) TheChinese gentleman discussed above, who hacked into acomputer system because he believed the operators ofthat system had attacked his system, was really assert-ing a defense of property theory (Ying-Cheng, 2001) Heclaimed he had to take affirmative action against thosewhom he believed were attempting to harm his computersystem (Ying-Cheng, 2001) Because he believed he wasacting to protect his property from unlawful conduct, hecould, subject to the qualifications discussed below, assert

a defense of property claim when he was charged with lawful hacking

un-The final justification defense is choice of evils Choice

of evils justifies the commission of a crime when one mits that crime to avoid a harm or evil greater than theharm or evil resulting from the commission of this offense(LaFave, 2003) The choice of evils defense would, for ex-ample, be available to one who cut a hole in a dam thatwas about to burst to prevent the dam from collapsing andflooding a town; the defense is available even if, by cut-ting the hole in the dam, the actor caused a nearby farm

com-to flood, killing livescom-tock or even a person (LaFave, 2003)

As long as the harm sought to be avoided (i.e., flooding thetown, which would cause great loss of life and property)

is greater than the harm inflicted (i.e., damage to the damplus the loss of a single life and property damage at thefarm), the actor is entitled to the choice of evils defense(LaFave, 2003) This defense could therefore serve as analternative basis for justifying the actions of the computer

Trang 39

B ASIC I NSTITUTIONAL S TRUCTURE 9

technician discussed earlier: the one who frustrated the

efforts of the cyberterrorist His actions could be

char-acterized either as defense of others (if we focus on the

threat coming from another person) or as choice of evils

(if we focus on the harm to be avoided versus the harm

resulting from his hacking into the computer system)

As this discussion of justification defenses shoulddemonstrate, they raise difficult issues of law and policy

When we allow someone to assert a justification defense,

we are, in effect, saying that they did the right thing by

taking the law into their own hands; because the legal

sys-tem cannot tolerate people’s taking the law into their own

hands as a matter of general practice, the law imposes

re-strictions on the assertion of the justification defenses to

ensure that they can be successfully asserted only in truly

compelling cases (LaFave, 2003) The restriction that is

common to all of the justification defenses is that the

ac-tor believed it was “necessary” to, in effect, take the law

into his or her own hands (LaFave, 2003) “Necessary” in

this context means that there were no viable, lawful

alter-natives (LaFave, 2003) To use the examples given above,

the computer technician who hacked into a computer

sys-tem to prevent the cyberterrorist’s attack from

succeed-ing would no doubt qualify for a justification defense

(de-fense of others or choice of evils) because it seems he had

no lawful alternatives; if he had contacted the

authori-ties and asked for their assistance, the attack would have

succeeded (LaFave, 2003) Conversely, the Chinese

gen-tleman who hacked a computer system he thought was

being used to attack his own system would not qualify for

a justification defense because it was not “necessary” for

him to take the law into his own hands; he could have

gone to the authorities, reported the attacks on his

sys-tem, and given them the information that led him to

be-lieve a particular computer system was being used in the

attacks The authorities could have handled matters from

there

Hack Back Defense

The above discussion of justification defenses logically

leads to the issue of vigilante action—what the law calls

“self-help”—as a response to cybercrime Some argue that

because the law enforcement response to cybercrime is

likely to be ineffective given the limited resources law

en-forcement has for this purpose plus the fact that many

cybercrimes are transnational in nature, it is only

rea-sonable to allow victims of hacking and other computer

crimes to “strike back” at the offenders (Loomis, 2001)

Those who advocate this approach claim that “you can’t

reason with attackers and you can’t coddle them—the only

language they understand is force” (Loomis, 2001) Those

who take this position believe that if a victim strikes back

at his/her attacker with sufficient force, this will deter that

attacker and similarly situated attackers from launching

future assaults on the victim’s system (Loomis, 2001) This

argument has an undeniable visceral appeal, because of

the apparent impunity with which many cybercriminals

operate Indeed, it has even led to the introduction of

pro-posed federal legislation that would legitimize self-help

against those who engage in criminal copyright violations

(H.R 5211, 2002)

Society, however, cannot tolerate vigilante behavior.This was true in the 19th century, when vigilantes were ac-tive in the American West, and it is still true today (Hine,1998) The drift toward vigilantism as a response to cy-bercrime is not surprising; vigilantism tends to appear in

“frontier” situations (i.e., when law enforcement is fective or absent; Hine, 1998) This is, of course, true ofcyberspace, which is often analogized to the Wild West.The problem is that although self-help can be a viscerallysatisfying approach to one’s victimization, it creates moreproblems than it solves: for one thing, vigilantes commitcrimes In the examples given in the previous section, boththe computer technician who is responding to the cyber-terrorist’s activities and the Chinese gentleman who is re-sponding to the attacks on his system are violating thelaw by hacking It is a fundamental premise of every legalsystem that citizens are not privileged to commit crimes(LaFave et al., 1999) It is true that, as the previous sec-tion explained, the law does absolve citizens who takethe law into their own hands under certain, very limited,situations; however, this is very different from a blanketauthorization for online retaliative behavior Aside fromanything else, such behavior is objectionable because ofthe risks that innocent parties will be targeted for retal-iation; the consequences of this risk are particularly in-tolerable in cyberspace, where it can be impossible toknow precisely from which system an attack was launched(Loomis, 2001) It is to avoid the possibility of harm to

inef-an innocent actor that the legal system has developed acomplex structure of rules and processes governing theimposition of sanctions upon those who are believed tohave committed crimes (LaFave et al., 1999)

Evidentiary Issues

Cybercrime cases present a variety of evidentiary issues,which can be broken down into two categories: (1) theprocess of gathering evidence and (2) the process of in-troducing evidence at trial

The process of gathering evidence differs depending onwhether the evidence is located in a stand-alone computer(desktop or laptop) or is on a network If the evidence is lo-cated on a stand-alone computer, the basic principle gov-erning law enforcement’s gaining access to the evidence

is the Fourth Amendment, which protects citizens from

“unreasonable” searches and seizures (LaFave, Israel, &King, 1999) If a seizure is “reasonable,” it does not violatethe Fourth Amendment (LaFave, Israel, & King, 1999) To

be “reasonable,” a search or seizure conducted by law forcement agents must be carried out either under the au-thority of a search warrant or under one of the exceptions

en-to the warrant requirement, such as consent (LaFave,Israel, & King, 1999) So, assume federal agents areinvestigating allegations that John Doe has child pornog-raphy on his home computer In scenario 1, they havegathered enough information to establish probable cause

to believe there is child pornography on his computer.They take that information to a magistrate—in the form of

an application for a search warrant and a sworn affidavitattesting to their probable cause—and obtain a warrant

to search for and seize child pornography (LaFave, Israel,

& King 1999) They take the warrant to John Doe’s house

Trang 40

10

and conduct the search either onsite, at his home, or seize

his computer and take it away for an offsite search In

sce-nario 2, the agents either do not have enough information

to establish the probable cause they need to get a warrant

or prefer to proceed without a warrant They approach

John Doe and ask him if they can search his computer; if

he consents, he waives his Fourth Amendment rights and

surrenders his ability to object to the search at a later date

(LaFave, Israel, & King, 1999)

The process of gathering evidence is far more

com-plex when the evidence is located on a network or on

sev-eral networks (Dean, 2003) Continuing the example used

above, assume the agents have received information that

John Doe is corresponding online with minors whom he

sends child pornography and whom he arranges to meet

for the purposes of having sexual relations The agents

could proceed as outlined above with regard to evidence

located on John Doe’s computer, but they also need

infor-mation about his e-mail contacts with the minors To learn

about that, they need information from Doe’s Internet

ser-vice provider (ISP) Because the Supreme Court has held

that the Fourth Amendment does not apply to records

held by a third party, the agents are not constitutionally

required to get a warrant to obtain the information they

need from the Internet service provider (LaFave, Israel, &

King, 1999) But because Congress was concerned about

unrestricted law enforcement access to records, it adopted

a series of statutes—the Electronic Communications

Pri-vacy Act of 1986 (ECPA)—which require law enforcement

to go through certain procedures to get evidence from

an Internet service provider and others who provide

elec-tronic communications services (Elecelec-tronic

Communica-tions Privacy Act) Under ECPA, the agents will have to

use a search warrant, a subpoena, or a court order to

ob-tain the information they need from the Internet service

provider (Dean, 2003) ECPA sets up different

require-ments for different types of information, but the critical

difference between it and the Fourth Amendment is that

agents can often use either a subpoena or a court order,

neither of which requires probable cause, to get the

infor-mation they require (Electronic Communications Privacy

Act)

The process of introducing electronic evidence, such as

that described above, at trial is a very complex one which

is quite beyond the scope of this chapter Generally, for

evidence to be admissible at trial it must be (a) relevant,

(b) authentic, and (c) reliable (Daubert v Merrell Dow

Pharmaceuticals, Inc., 1993) The issue of relevance is

sel-dom problematic; evidence is “relevant” when it tends to

prove the fact for which it is offered (i.e., child

pornogra-phy was found on John Doe’s computer) and when that

fact is material to an element in the case (i.e., John Doe

is being prosecuted for possessing child pornography;

Mueller & Kilpatrick, 2003) Authenticity can be

prob-lematic, because digital evidence can be altered easily, the

party offering digital evidence must be able to establish

that it is what it is claimed to be (U.S Department of

Jus-tice Computer Crime and Intellectual Property Section,

2002) To establish this and rebut defense claims that

ev-idence has been altered, the prosecution will typically

es-tablish a chain of custody for the evidence; that is, the

prosecution will typically trace the processes that were

used to find the evidence and retrieve it from a computer

or from a network (U.S Department of Justice ComputerCrime and Intellectual Property Section, 2002) Establish-ing a chain of custody authenticates digital evidence byshowing that it was never left unsecured in conditionsthat would have permitted its alteration (U.S Department

of Justice Computer Crime and Intellectual Property tion, 2002) Reliability raises similar concerns; the defensemay, for example, claim that a computer-generated recordthat the prosecution is offering as evidence is not reliablebecause the program used to create it contained seriousprogramming errors (U.S Department of Justice Com-puter Crime and Intellectual Property Section, 2002) Forthe prosecution to overcome such a challenge and estab-lish the reliability of the record in question, it will have toestablish that the computer program did, in fact, meet therequisite standard of reliability (U.S Department of Jus-tice Computer Crime and Intellectual Property Section,2002)

Sec-Sentencing

As explained, sentencing is done by a judge; in imposingsentence, a judge is guided by a set of rules that defineeither the required sentence or an allowable range of sen-tences (LaFave et al., 1999) There are four basic ratio-nales for inflicting punishment on offenders: incapacita-tion (to physically prevent this person from reoffending),deterrence (to discourage this person and others fromcommitting similar crimes), rehabilitation (to educate theperson so that he/she no longer desires to commit crimes),and retribution (to retaliate for the harm the offender hascaused) (LaFave, 2003) Since the 1980s, sentencing inthe federal and state systems has been based on deter-rence, retribution, and incapacitation, a reaction againstrehabilitation, which had been the primary rationale forsentencing since the 19th century A new approach began

in the 1970s and culminated in the adoption of new tencing provisions that emphasize the need to deter andincapacitate offenders and society’s need for retribution(Vitiello, 1991)

sen-Victims and their families have increasingly been giveninput into the sentencing process; the federal system andmost states either permit or require the use of victim im-pact statements, which assess a crime’s impact on the vic-tim and the victim’s family at sentencing (LaFave et al.,1999) This practice extends to cybercrime cases; in thefederal system, for example, victims of criminal copyrightinfringement are statutorily guaranteed the right to sub-mit a victim impact statement documenting their lossesprior to sentencing (U.S Department of Justice ComputerCrime and Intellectual Property Section, 2001)

In 2003, three groups submitted a statement to theU.S Sentencing Commission arguing that those convicted

of computer crimes are already being punished moreseverely than those convicted of similar crimes that donot involve the use of computer technology (NationalAssociation of Criminal Defense Lawyers, ElectronicFrontier Foundation & Sentencing Project 2003) Thestatement argued against increasing penalties for federalcomputer crimes (a) because the incidence of computercrime is low, (b) because loss calculations currently in use

Định dạng
Số trang	1.008
Dung lượng	13,72 MB