Stored Data from Networks Often More complicated that stand-alone
Statutory rules based on the type of data on the network
Electronic communications Privacy Act (ECPA)
Others
Network Devices and ECPA..61
ECPA governs access to and disclosure of stored files
provider/customer/government roles
Cannot necessarily share stored files with others
Three main categories are covered
Communications (e.g., e-mail, voicemail, other files)
Transactional Data (e.g., Logs reflecting with whom users communicated)
Subscriber/Session Information
-
What stored communications records can network operators voluntarily provide to law enforcement?..62
A private provider may disclose all without violating ECPA
Content
Transactional data
User information
A public provider looks to statutory exceptions before disclosing content or non-content to government..64
Public provider may voluntarily disclose the content of communications to government when:
Consent to do so exists (e.g., via a banner)
Rights and property will be protected.
Contents inadvertently obtained & pertain to commission of a crime.
The provider, in good faith, believes that an emergency involving dager of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency.
Public provider may voluntarily disclose non-content records concerning a customer or subscriber:..65
When consent from the subscriber to do so exists (e.g., via a banner or user agreement)
To protect provider's rights and property
To the government “if the provider,in good faith, believes that an emergency involving dager of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency.”
To any person other than a governmental entity
Real-Time..67
Cannot intercept contents unless an exception applies; it's a wiretap
Three Key exceptions:
Monitoring; Provider Exception..68
Allows provider to conduct reasonable monitoring
Is a limited exception. Not a crminal investigator's privilege.
System administrator can track hackers within their networks in order to prevent further damage.
scope not unlimited, need to tailor monitoring to its purpose.
Monitoring; Consent Exception..70
Interception allowed when user consents “in fact”
Banner the Network
obtain the written consent of autorized users.
Monitoring; Trespasser Exception..71
Computer trespasser exception
Allows law enforcement to intercept communication to or from “computer tresspassers”
Even if trespasser is using system as a pass through to other down-stream victims
A “computer trespasser” cannot be a person known by the provider to have an existing contractual relationship with the provider for use of the system
Conditions:
The provider authorizes the interception,
The person intercepting is “under color of law”
The communication are relevant to an ongoing investigation and
No communications other than those sent to or received by the trespasser are intercepted.
Provider receives immunity
May combine this authority with other exceptions, such as consent.
Monitoring; Header Information..73
The Pen Registers, Trap and Trace Devices Statue governs real-time monitoring of traffic data (e.g., most e-mail header information, source and distination IP address and port)
Does not include content of communication (e.g., e-mail subject line or content of a downloaded file.)
For non-content informationlike packet headers, rules are more flexible
Provider exception is broad.
Consent of user still allows acquisition
Lawful Access Legislation..75
“Lawful Access” legislation
Common Scope of requirements
Common Permanent Capability Requirements
Ability to isolate target subscriber
capture in real-time
Without tipping-off the target
Target list secure from outsiders and un-cleared insiders
CALEA and IP switching
HIPPA..77
HIPAA Creates Uniform Federal Privacy Standard for Protected Health Information (PHI)
Covers
HHS Implemented Security Rule to Protect Electronic PHI
Covered Entities required to implemented safeguards
Penalties for violation potentially serious
If data from a “covered entity” made sure you're not in violation
SOX..79
Sarbanes-Oxley (US Public Company Account Reform and Investor Protection Act)
Aimed at preventin, detecting and responding to insider fraud
Serious sanctions for data destruction to impact government investigation
Corporate governance policies, including
GLB..80
Gramm-Leach-Bliley (Financial Services Modernization Act
Aimed at Financial Institution
Focus is protecting personally Identifiable financial information
FERPA..81
Family Education Rights and Privacy Act
Aimed at Educational Institutions
Focus is protecting personally identifiable information about students
Other Data Worthy of Mention..82
Child Pornography
Credit Card Information
Social Security Numbers
Passwords
Warez
Attorney Materials
Outside Reconnaissance..83
Common Network Tools
Aggressive
Tools
Normal Logging (Business Records)
Investigative tools
Courts like audit trails
Whatever tool you use, keep notes