2  May  2011  –  WORKSHOP  -­‐  The  Death  Of  Computer  Forensics:  Digital  Forensics  After  the  Singularity  

 Workshop  participants  Cory  Altheide   (Google)  Carlo  Blengino   (Lawyer),   Francesca  Bosco   (UNICRI   -­‐  Project  Officer,  Emerging  Crimes  Unit)  Elia  Florio   (Data  Protection  Authority),  Roberto  Flor   (University  of  Verona   -­‐  Faculty  of  Law),  Davide  Gabrini  (Postal  Police),  Rodrigo  Rodriguez  (ATOS  Research),  Monica  Senor  (Lawyer).    Moderators  were:  Giuseppe  Vaciago  (University  of  Milan  -­‐  Faculty  of  Law)  and  Stefano  Zanero  (Politecnico  di  Milano).      

Summary  of  the  Workshop  (Giuseppe  Vaciago)  

 I.  Technical  Challenges  of  Cloud  Forensics  II.  Legal  Challenges  of  Cloud  Forensics  III.  Conclusions    

***    The   lecture   by   Cory   Altheide1  also   served   as   an  opportunity   to   organize   a   workshop   in   which  lawyers,   computer   scientists,   policy   makers   and  members  of   law  enforcement  met   to  discuss   the  future   of   digital   forensics   in   the   cloud   and  defining   the   challenges   that   this   technology   will  face  in  coming  years.    

                                                                                                               1 Cory Altheide has nine years of information security, forensics & incident investigations experience. Cory worked at IBM, Google and the National Nuclear Security Administration (NNSA). At IBM, Mr. Altheide performed emergency computer security response for clients ranging from international banks to defense contractors to Fortune 500 retailers. At Google, he managed the response to numerous incidents, ranging from externally reported cross-site scripting vulnerabilities in Google properties, to compromised systems and extortion attempts. Prior to joining Google, Mr. Altheide was the Senior Network Forensics Specialist in the National Nuclear Security Administration's Information Assurance Response Center (NNSA IARC). Mr. Altheide has authored two original research papers for the Computer forensics journal "Digital Investigation” and co-authored “Handbook of Digital Forensics and Investigation (2009).” He holds the SANS GCIH and GCFA certifications.

A   number   of   technical   and   legal   considerations  emerged   and   these   will   serve   as   the   basis   for   a  paper   that   the   Polytechnic   of   Milan   and   the  University  of  Milan  Bicocca  are  due  to  draft  in  the  coming  months.  Below  is  a  brief  summary  of  the  matters   of   interest   that   emerged   during   the  workshop.    I.  Technical  Challenges  of  Cloud  Forensics    1.   Although   it   has   become   clear   that   computer  forensics   -­‐   the   practical   analysis   of   digital   data  following   the   acquisition   of   a   bit-­‐stream   image   -­‐  of  a  suspect's  hard  disk  -­‐  suffered  a  setback  with  the   wide   adoption   of   mobile   devices   and   the  increasing   use   of   flash   memory   and   encryption  systems,   it   is   undoubtedly   also   the   case   that   it  experienced   a   fundamental   change      due   to   the  incredible  expansion  of  cloud  computing  systems.    2.  In  order  to  arrive  at  this  "dramatic"  conclusion,  we   need   to   start   with   the   definition   of   cloud  computing   data   devised   by   NIST:   "Cloud  computing  is  a  model  for  enabling  convenient,  on-­‐demand   network   access   to   a   shared   pool   of  configurable   resources   (eg,   networks,   servers,  storage,   applications,   and   services)   that   can   be  rapidly   provisioned   and   released   with   minimal  effort   or   management   service   provider  interaction.”   Cloud   computing   has   five   essential  characteristics,   i.e.,   on-­‐demand   self-­‐service,  broad   network   access,   resource   pooling,   rapid  elasticity   and   measured   service.   It   has   three  service  models,   i.e.,  Cloud  Software  as  a  Service  (SaaS),   Cloud   Platform   as   a   Service   (PaaS)   and  

Cloud  Infrastructure  as  a  Service  (IaaS).  And  it  has  four   deployment   models,   i.e.,   private   cloud,  community  cloud,  public  cloud  and  hybrid  cloud”  (Mell  and  Grance,  2009).      3.   The   various   types   of   service   or   deployment  models  described  above    pose  an  initial  problem,  insofar   as   they   require   the   use   of   specialized  cloud   forensic   techniques   that   are   extremely  different   from   one   another:depending   on   the  different  cloud  service  models  involved,  the  tools  and  procedures  used  to  collect  forensic  data  also  differ   (e.g.,   in   public   clouds,   provider-­‐side  artifacts   need   to   be   segregated   among   multiple  tenants,   whereas   in   private   clouds,   there   is   no  such  need).    4.  But  this  is  just  the  beginning:  in  digital  forensics  the   key   process   and   techniques   require   that   the  software   must   be   tested,   checked   and   that   the  operations   performed   on   digital   evidence   must  be   repeatable   and   documented.   It   is   possible   to  divide   the   classic   digital   forensics   into   three  scenarios:   :  A.  Data  at   rest   (traditional  computer  forensics,   ex:   disk   imagining)   B.   Data   in   transit  (network   forensics)   C.  Data   in   execution   (live   or  memory   forensics).   If   we   transpose   this   same  breakdown  to  cloud  computing,  we  would  notice  immediately   that  data  at   rest  does  not  reside  on  the  device   except   for   the   few   tracks   that   can  be  found  in  the  cache  or  temporary  files;  that  data  in  transit   can   not   be   easily   analyzed   because   the  major   cloud   providers   will   encrypt   all   traffic   to  keep  that  cloud  instance  secure  from  neighboring  threats   ;   while   this   reduces   the   risk   of   illegal  interception   and   the   risk   of   tampering,   it   also  makes   it   more   difficult   for   legitimate  investigators.  Finally,   ,    any  data   in  execution  will  be   present   only   in   the   cloud   instance   and   it  will  be   equally   difficult   to   exploit   this   during   an  investigation      5.   It   is   clear   that   the   most   difficult   challenge   is  posed  by  the  loss  of  data  control:    virtualization  is  one  of  the  key  elements  in  the  implementation  of  cloud   services,   while   in  most   cases   investigators  require   evidence   to   be   obtained   from   physical  devices     Furthermore,   data   from   the   cloud   only  makes   sense   when   interpreted   using   the  appropriate   cloud   communication  protocols.   The    investigator  who  wants  to  capture  the  bit-­‐stream    data  of  a  given  suspect  image  will  be  in  the  same  situation   as   someone   who   has   to   complete   a  

jigsaw   puzzle   whose   pieces   are   scattered  randomly   across   the   globe.   But   that's   not   all:  even  if  it  were  possible  to  reconstruct  the  image,  the  investigator  would  never  be  able  to  validate  it  “beyond  a  reasonable  doubt”  in  the  same  way  as  would  be  possible  with  a  physical  hard  drive.      6.   Finally,   in   traditional   computer   forensics,  recovered  deleted  data  is  an  important  source  of  evidence,  so  it  is  in  the  cloud  as  well.  With  cloud  providers,  the  right  to  alter  or  delete  the  original  snapshot   is   explicitly   reserved   for   the   user   that  created   the   volume.   When   item   and   attribute  data  are  deleted  within  a  domain,  removal  of  the  mapping   within   the   domain   starts   immediately,  and   is   also   generally   complete   within   seconds.  Once  the  mapping  is  removed,  there  is  no  remote  access  to  the  deleted  data.  It  is  likely  that  storage  space   will   be   overwritten   by   newly   stored   data.  However,   some   deleted   data   might   be   still  present   in   the   snapshot   after   deletion.   The  challenge   is   then:   how   to   recover   deleted   data,  identify   the   ownership   of   deleted   data,   and   use  deleted  data  as  sources  of  event  reconstruction  in  the   cloud?   (Keyun   Ruan,   Prof.   Joe   Carthy,   Prof.  Tahar  Kechadi,  Mark  Crosbie,  Cloud  forensics:  An  overview,  Digital  Forensics,  Vol.  7  by  Springer).    II.  Legal  Challenges  of  Cloud  Forensics    1.  The  “loss  of  location”  of  digital  evidence  in  the  cloud  world  creates  problem  of  jurisdiction.  Over  the  last  few  years,  various  approaches  have  been  offered   to   solve   this   problem.   The   traditional  approach   is   the   territorial   principle  by   virtue   of  which   the   Court   in   the   place   where   the   data   is  located   has   jurisdiction   (Art.   32,   Convention   on  Cybercrime).   This   approach   essentially   prohibits  any  type  of   investigation  because  even  the  cloud  provider  might  not  know  exactly  where   the  data  is   located.   Another   approach   is   the   nationality  principle  by  virtue  of  which  the  nationality  of  the  perpetrator   is   the   factor   used   to   establish  criminal   jurisdiction.   This   principle   imposes  certain   restrictions   since   the   perpetrators   in   a  cybercrime  case  might  easily  be  foreign  nationals,  given   that   cybercrime   is   generally   transnational  and   there   is   no   need   for   physical   proximity.  Furthermore,  data  does  not  have  a  nationality  as  it  is  an  attribute  of  an  individual.  A  third  approach  is  the  “flag  principle”,  which  basically  states  that  crimes   committed   on   ships,   aircraft   and  spacecraft   are   subject   to   the   jurisdiction   of   the  

flag  state,  regardless  of  their  location  at  the  time  of  the  crime  (art.  22,  Convention  on  Cybercrime).  Since   digital   data   is   constantly   changing,   this  principle  also  seems  to  be  applicable  to  the  cloud  world.   However,   to   potentially   apply   this   to   the  cloud   computing   scenario,   we   must   remember  that   clouds  might  not  be   the  actual  place  where  the   crime  was   committed  and   that   this   principle  could   motivate   cybercriminals   to   select   a   cloud  computing  provider  under  a  “pirate  flag”.    2.   A   recent   discussion   paper,   prepared   by   Jan  Spoenle   for   the   Economic   Crime   Division   of   the  Council  of  Europe  (Directorate  General  of  Human  Rights  and  Legal  Affairs)  within  the  framework  of  the   global   Project   on   Cybercrime,   suggested   the  “Power   of   Disposal   Approach”.  From  a   practical  point  of  view,  a  regulation  based  on  the  power  of  disposal  approach  would  make   it   feasible  for   law  enforcement  to  access  a  suspect’s  data  within  the  cloud.   Law   enforcement   would   only   have   to  legally   obtain   the   username   and   password  combination  and  be  able  to  prove  that  additional  requirements  have  been  met.    This   type   of   approach   certainly   overcomes   any  legal   issue  but  a  balance  must  be  struck  with  the  legitimate  need   for  privacy  and   the   rights  of   the  suspect  as  well.  Furthermore,   this  approach  may  not   be   easy   to   take,   because   many   devices  (particularly  mobile   ones)   are   protected   through  the  use  of  DRM;  which,   in  addition  to  preventing  the  installation  of  unauthorized  software,  provide  a   level   of   security   that   would   make   access  through   Trojan   horses   or   other   malicious  software  very  complicated.    3.  Another  extremely  sensitive   issue   in  the  cloud  is  data   retention,  since  this   is  a  key  factor   in  the  facilitation  of  investigation  activities.  The  scope  of  Directive   2006/24/EC,   however,   is   very   well  defined   and,   as   such,   limited.   From   an   objective  point   of   view,   it   is   limited   in   scope,   since   it  concerns   only   certain   traffic   and   location   data  generated   through   the   use   of   electronic  communications.  From  a  subjective  point  of  view,  it   concerns   only   providers   of   publicly   available  electronic  communications  services  or  of  a  public  communications  network.  This  begs  the  question  of  who  exactly  are  the  providers  subject  to  these  obligations,   and   whether   cloud   providers   are  included  in  this  definition.      

4.  These  considerations  and  recent  constitutional  court  rulings  (Bulgaria  2008,  Romania  2009,  2010  Germany,   Czech   Republic   2011)   which   have  declared   the   unconstitutionality   of   the   directive  on  data   retention   force  us   to   carry  out  a   rethink  in   terms  of  a  new   system  of   data   retention   and  regulation   in   the   cloud     and   the   provision   of  specific   obligations   for   different   actors,   in  particular:   a   standardized   data   retention   period  across   countries   or   mutually   agreed   recognition  principles   so   that   the   retention  period  applied   is  based   on   where   the   user’s   data   is   stored;  standardized  security  standards;  standardized  and  high  level  data  protection  standards;  and  a  rule  of  exceptionality   of   data   retention,     where  proportionate  and  intended  to  protect   important  and   dominant   legal   interests   and   in   the   fight  against   serious   crimes.     The   choice   should   be  based   on   agreed   criteria,   but   not   just   in   Europe  and  between  European  States.    5.   In   this   scenario,   cloud   computing   is   a   perfect  setting  for  the  activities  of  cybercriminals.  Recent  reports   confirm   that   cybercriminals   are   relying  more   on   cloud   computing   models   to   carry   out  cyberattacks.   Cybercriminals   will   either   be  manipulating   the   connection   to   the   cloud,   or  attacking  the  data  center  and  cloud  itself.  In  fact,  the   cloud   gathers   traffic   at   centralized   locations,  allowing  them  to  achieve  critical  mass  for  attacks.  Well-­‐organized   cybercriminals   also   can   easily  harvest   botnets   via   common   cloud   applications,  which   are   not   new   but   have   become   more  prevalent   in   the   recent   times,   as   users   continue  to   let   their   guard   down   and   network   with  increasing  speed  online.      6.   Last   but   not   least,   we   should   not   forget   the  difficulties   that   can   be   encountered   in   legal  proceedings,   where   it   is   not   always   possible   to  obtain  a  clear  validation  of  digital  evidence.  If,  for  example,  digital  evidence  has  been  wiped  by  the  user   and   the   cloud-­‐based   system   has   also  overwritten  that  portion  of  the  hard  disk,  will  the  court   be   able   to   judge   the   corresponding   digital  evidence   impartially  and  effectively   (especially   in  criminal  matters)?    III.  Conclusions    There   are   many   challenges   posed   by   cloud  forensics   and   just   as   many   legal   issues   that   will  need  to  be  addressed  in  the  coming  years.  

 On   the   technical   side,   with   regard   to    Infrastructure   as   a   Service,   it   can   be   assumed   -­‐  without   the   same   guarantees   of   success   -­‐   that  both   traditional   digital   forensic   solutions   and  cloud  forensic  tools  will  need  to  use  the  cloud  as  a  discovery  engine  for  rapid  and  accurate  forensic  investigations.   This   means   that,   although   new  approaches   and   systems   must   be   developed,  above   all   a   strong  working   relationship   needs   to  be  developed  with  cloud  providers.    On   the   legal   side,   the   topic   of   data   retention  provides   examples   of   the   problems   associated  with   jurisdiction.   Faced   with   a   total   absence   of  regulations   on   data   retention   in   the   United  States,   at   the   European   level   a   very   different  

situation   prevails:   the   latter   features   very   strict  regulation,   even   if   this   is   controversial   and   not  entirely   applicable   to   cloud   computing.   To   this  must   be   added   the   procedural   difficulty   of  successfully   presenting   cloud-­‐based   evidence   in  court   in   a   way   that   is   both   admissible   and  reliable.   This   uncertainty   can   only   encourage  cybercrime   and,   above   all,   create   a   climate   of  distrust   towards   a   particular   technology   that  offers,   apart   from   obvious   cost   savings,   massive  potential.     If   it   is   true   that   the   law   often   lags  behind   technology,   a   reassessment   of   digital  forensics   is   now   essential   and   will   need   to   be  carried  out,   if  possible,  by   lawyers  and  computer  scientists  working  in  collaboration.