Agents, Trojans and tags: The next generation of investigators

Abstract

In a statement the Council of the European Union has recommended that member states should introduce clandestine remote searches of computers as a standard investigation method to combat cybercrime. At present, there is little analysis of the consequences such a development will have in the UK. The use of remote forensic software tools by law enforcement agencies has been, however, controversially discussed elsewhere and most notably in Germany where the Federal Constitutional Court had the opportunity to analyse the issue. This paper describes the use of this investigation method in Germany and analyses the reaction of the German and some other legal systems to give a first indication of the likely issues that its use in the UK will raise.

Keywords:

• remote searching
• digital evidence
• regulation

Notes

Council of the European Union, ‘Council Conclusions on a Concerted Work Strategy and Practical Measures Against Cybercrime’, 2987th Justice and Home Affairs Council meeting, 27–28 November 2008, available at http://www.ue2008.fr/webdav/site/PFUE/shared/import/1127_JAI/Conclusions/JHA_Council_conclusions_Cybercrime_EN.pdf

BVerfG, NJW 2008, 822.

D. Leppard, ‘Police Set to Step up Hacking of Home PCs’, Timesonline, 4 January 2009, available at http://www.timesonline.co.uk/tol/news/politics/article5439604.ece; K. Leipold, ‘Die Online-Durchsuchung’, Neue Juristische Wochenschrift, Spezial 4 (2007): 315.

U. Buermeyer, ‘Die “Online-Durchsuchung” – Technischer Hintergrund des verdeckten hoheitlichen Zugriffs auf Computersysteme’, Onlinezeitschrft für Höshstrichterliche Rechtsprechung zum Strafrecht 4 (2007): 154.

Ibid.

G. Hornung, ‘Ermächtigungsgrundlage für die “Onlinedurchsuchung”?’, Datenschutz und Datensicherheit 31 (2007): 575–580.

BGH, NJW 2007, 930.

Gesetz-und Verordnungsblatt für das Land Nordrhein-Westfalen, Jahrgang 2006, Seite 620 (GVBl NW 2006).

BVerfG, see note 2.

Leppard, ‘Police Set to Step up’.

N. Morris, ‘New Powers for Police to Hack your PC’, The Independent, 5 January 2009, available at http://www.independent.co.uk/news/uk/home-news/new-powers-for-police-to-hack-your-pc-1225802.html

U. Hellmann, Strafprozessrecht (Heidelberg: Springer, 2005), 146.

BVerfG, NJW 2006, 976; BVerfG, NJW 2005, 1917; BGH, NStZ 2003, 670.

T. Böckenförde, Die Ermittlung im Netz (Tübingen: Mohr Siebeck, 2003).

BGH, see note 7.

The interception of email traffic data could be subsumed under this article if it is a live interception; hence a dataflow exists between the suspect and the recipient. Due to their design however, RFS tools are most likely to search emails stored on the computer of the suspect. Also, a live interception of email traffic is technically still very difficult, if not impossible (G. Hornung, ‘Ein neues Grundrecht’, Computer und Recht 5 (2008): 299).

BGH, see note 7.

B. Schafer, ‘The Taming of the Sleuth-Problems and Potential of Autonomous Agents in Crime Investigation and Prosecution’, International Review of Law, Computers & Technology 20, nos. 1&2 (2006): 63.

See for example in Germany, BVerfG, NJW 1990, 563.

BVerfG, see note 2.

German case law in the area developed subtle distinctions between a non-negotiable core of privacy and an ‘outer layer’ or privacy interest that can be balanced against other rights.

BVerfG, see note 2.

C. Frank, In ‘Richter halten Kontrolle von heimlichen Online-Durchsuchungen für illusorisch’, Heise 28.02.2008, available at http://www.heise.de/newsticker/Richter-halten-Kontrolle-von-heimlichen-Online-Durchsuchungen-fuer-illusorisch–/meldung/104238

A serious crime is defined as any offence attracting a jail sentence of three years or more.

See for example the case where a family was put under surveillance for ‘suspected fraudulent school place applications’ under provisions of RIPA, BBC, ‘Council admits spying on family’, April 2008, available at http://news.bbc.co.uk/1/hi/england/dorset/7341179.stm

E. Casey, Digital Evidence and Computer Crimes (London: Academic Press, 2004).

E.E. Kenneally, ‘Confluence of Digital Evidence and the Law: On the Forensic Soundness of Live-Remote Digital Evidence Collection’, UCLA Journal of Law and Technology 9, no. 2 (2005): 3.

Ibid.

B.J. Nikkel, ‘Improving Evidence Acquisition from Live Network Sources’, Digital Investigation 3 (2006): 89.

E. Casey and A. Stanley, ‘Tool Review – Remote Forensic Preservation and Examination Tools’, Digital Examination 1 (2004): 284.

E. George, ‘UK Computer Misuse Act – The Trojan Virus Defence Regina v Aaron Caffrey, Southwark Crown Court, 17 October 2003’, Digital Investigation 1, no. 2 (2004): 89.

For the purpose of this article the focus will be on the crossing of borders between nation states. For a detailed analysis of the problem of borders in relation to the use of RFS tools see W. Abel and B. Schafer, ‘Big Browser Manning the Thin Blue Line – Computational Legal Theory Meets Law Enforcement’, Problema 2 (2008): 51.

M. O'Neill, Policing Football: Social Interaction and Negotiated Disorder (Basingstoke: Palgrave Macmillan, 2005), 137.