A novel approach of mining write-prints for authorship attribution in e-mail forensics

There is an alarming increase in the number of cybercrime incidents through anonymous e-mails. The problem of e-mail authorship attribution is to identify the most plausible author of an anonymous e-mail from a group of potential suspects. Most previous contributions employed a traditional classification approach, such as decision tree and Support Vector Machine (SVM), to identify the author and studied the effects of different writing style features on the classification accuracy. However, little attention has been given on ensuring the quality of the evidence. In this paper, we introduce an innovative data mining method to capture the write-print of every suspect and model it as combinations of features that occurred frequently in the suspect's e-mails. This notion is called frequent pattern, which has proven to be effective in many data mining applications, but it is the first time to be applied to the problem of authorship attribution. Unlike the traditional approach, the extracted write-print by our method is unique among the suspects and, therefore, provides convincing and credible evidence for presenting it in a court of law. Experiments on real-life e-mails suggest that the proposed method can effectively identify the author and the results are supported by a strong evidence.     

OBA2: An Onion approach to Binary code Authorship Attribution

A critical aspect of malware forensics is authorship analysis. The successful outcome of such analysis is usually determined by the reverse engineer's skills and by the volume and complexity of the code under analysis. To assist reverse engineers in such a tedious and error-prone task, it is desirable to develop reliable and automated tools for supporting the practice of malware authorship attribution. In a recent work, machine learning was used to rank and select syntax-based features such as n-grams and flow graphs. The experimental results showed that the top ranked features were unique for each author, which was regarded as an evidence that those features capture the author's programming styles. In this paper, however, we show that the uniqueness of features does not necessarily correspond to authorship. Specifically, our analysis demonstrates that many “unique” features selected using this method are clearly unrelated to the authors' programming styles, for example, unique IDs or random but unique function names generated by the compiler; furthermore, the overall accuracy is generally unsatisfactory. Motivated by this discovery, we propose a layered Onion Approach for Binary Authorship Attribution called OBA2. The novelty of our approach lies in the three complementary layers: preprocessing, syntax-based attribution, and semantic-based attribution. Experiments show that our method produces results that not only are more accurate but have a meaningful connection to the authors' styles.     

Identification of authorship using lateral palm print--a new concept

Identification of individual by signature examination could be improved by the lateral palm print examination. By the use of new technique discussed by the author in this paper, the forensic expert can find out very useful information about the writer of writings even without going into the depth of questioned document/signature examination and without the formal or informal handwriting exemplars. The document expert with little more knowledge of the palm print can identify whether the signature is done by hand/leg/anything else, whether the author is right handed or left handed, the approximate age of the author, whether the signature is genuine or forged. Such information of author would be very much useful in elimination of the list of suspects of anonymous letters. In order to fix the authorship, standard and disputed lateral palm prints can be examined either with photographic superimposition technique or with the statistical study of the outline of the lateral palm print or with the standard method as implied in fingerprint examination. The evidential value of such lateral palm print can be placed at par with the finger prints in the court of law and could be placed right on the top of all other scientific evidences.     

“署名”三辨——兼评“安顺地戏案”等近期案例

作品上的自然人的姓名或组织的名称并非都是《著作权法》意义上的"署名"。"署名"必须针对特定作品表明作者的身份,因此有别于剧种名称,如"安顺地戏"等。根据英美法系国家版权法和《世界版权公约》的规定,"■"标记之后所接的姓名或名称表示的是版权归属,并非表明作者身份的"署名"。而且在版权归属于一个组织的情况下,该组织不可能对作品享有"署名权"。""标记之后所接的姓名或名称表示的则是商标注册人。即使图形商标构成作品,由于存在许可使用的情形,该姓名或名称也并非"署名"。只有作者才享有在作品上"署名"的权利,因此在作品上冒他人之名并非侵犯他人"署名权"的行为。     

Author gender identification from text

Text is still the most prevalent Internet media type. Examples of this include popular social networking applications such as Twitter, Craigslist, Facebook, etc. Other web applications such as e-mail, blog, chat rooms, etc. are also mostly text based. A question we address in this paper that deals with text based Internet forensics is the following: given a short text document, can we identify if the author is a man or a woman? This question is motivated by recent events where people faked their gender on the Internet. Note that this is different from the authorship attribution problem.In this paper we investigate author gender identification for short length, multi-genre, content-free text, such as the ones found in many Internet applications. Fundamental questions we ask are: do men and women inherently use different classes of language styles? If this is true, what are good linguistic features that indicate gender? Based on research in human psychology, we propose 545 psycho-linguistic and gender-preferential cues along with stylometric features to build the feature space for this identification problem. Note that identifying the correct set of features that indicate gender is an open research problem. Three machine learning algorithms (support vector machine, Bayesian logistic regression and AdaBoost decision tree) are then designed for gender identification based on the proposed features. Extensive experiments on large text corpora (Reuters Corpus Volume 1 newsgroup data and Enron e-mail data) indicate an accuracy up to 85.1% in identifying the gender. Experiments also indicate that function words, word-based features and structural features are significant gender discriminators.     

Results from experimental trials testing participant responses to White, Hispanic and Black suspects in high-fidelity deadly force judgment and decision-making simulations

Objective

Advance the methodological techniques used to examine the influence of suspect race and ethnicity on participant decisions to shoot in an experimental setting.

Methods

After developing and testing a novel set of 60 realistic, high definition video deadly force scenarios based on 30 years of official data on officer-involved shootings in the United States, three separate experiments were conducted testing police (n?=?36), civilian (n=?72) and military (n?=?6) responses (n?=?1,812) to the scenarios in high-fidelity computerized training simulators. Participants’ responses to White, Black and Hispanic suspects in potentially deadly situations were analyzed using a multi-level mixed methods strategy. Key response variables were reaction time to shoot and shooting errors.

Results

In all three experiments using a more externally valid research method than previous studies, we found that participants took longer to shoot Black suspects than White or Hispanic suspects. In addition, where errors were made, participants across experiments were more likely to shoot unarmed White suspects than unarmed Black or Hispanic suspects, and were more likely to fail to shoot armed Black suspects than armed White or Hispanic suspects. In sum, this research found that participants displayed significant bias favoring Black suspects in their decisions to shoot.

Conclusions

The results of these three experiments challenge the results of less robust experimental designs and shed additional light on the broad issue of the role that status characteristics, such as race and ethnicity, play in the criminal justice system. Future research should explore the generalizability of these findings, determine whether bias favoring Black suspects is a consequence of administrative measures (e.g., education, training, policies, and laws), and identify the cognitive processes that underlie this phenomenon.     

Privacy,anonymity and liability: Will anonymous communicators have the last laugh?

In this paper, the author sets out the way in which the UK approach to privacy protection is able to extend its reach to anonymous postings. Whilst anonymity might sometimes be seen as one of the essential characteristics of communicating on-line, it does not provide an impenetrable veil of protection in respect of a privacy violation claim. Instead, there are avenues available to identify anonymous communicators, which have implications both for internet freedom and jurisdiction in cyberspace. In the UK, our common law has not denied bloggers, or other on-line contributors, anonymity per se. However, it will be argued that recent UK judgments represent a warning to anonymous communicators that they can be held liable for what they post on-line and that naivety is no defence at law. Whilst on-line platforms allow people to effectively become journalists; to become publishers, as familiar users, they should become more aware of the consequences of their on-line postings and appreciate that they will not be able to escape from the application of third party disclosure orders. However, as these are not without their problems, it is possible that anonymous communicators may have the last laugh.     

Digital evidence: Unaddressed threats to fairness and the presumption of innocence

Contemporary criminal investigation assisted by computing technology imposes challenges to the right to a fair trial and the scientific validity of digital evidence. This paper identifies three categories of unaddressed threats to fairness and the presumption of innocence during investigations – (i) the inappropriate and inconsistent use of technology; (ii) old procedural guarantees, which are not adapted to contemporary digital evidence processes and services; (iii) and the lack of reliability testing in digital forensics practice. Further, the solutions that have been suggested to overcome these issues are critically reviewed to identify their shortcomings. Ultimately, the paper argues for the need of legislative intervention and enforcement of standards and validation procedures for digital evidence in order to protect innocent suspects and all parties in the criminal proceedings from the negative consequences of technology-assisted investigations.     

Interviewing to Elicit Cues to Deception: Improving Strategic Use of Evidence with General-To-Specific Framing of Evidence

Previous research has demonstrated that the strategic use of evidence (SUE) approach of interviewing criminal suspects is effective at eliciting cues to deception. This study aims at expanding on the SUE approach by testing the technique of general-to-specific evidence framing. We conducted an experiment using a mock terrorism paradigm. Guilty participants took part in a simulated act of terrorism, while innocent participants performed a similar act involving no transgression. All participants (N?=?102) were then interviewed using one of four evidence disclosure styles (early disclosure, late disclosure, 2-step disclosure, or 4-step disclosure). We expected that disclosing evidence to the suspect gradually, with increasing specificity, would induce guilty suspects to alter their statements to a greater extent than innocent suspects. General-to-specific evidence framing effectively discriminated between guilty and innocent suspects, but results only partially supported the hypotheses.     

Contribution and collaboration in joint authorship: too many misconceptions

Legal context: This Article examines the requirements of collaborationand contribution in joint authorship. It discusses the mainUK case law and provides a comparative assessment of the requirementsin the US and Canada. Key points: The author identifies and examines misconceptionssurrounding the definition of joint authorship; the nature ofthe requirements of collaboration and contribution; the confusionwithin the definition of what amounts to sufficient contribution.The author asserts that joint authorship cannot be determinedby using similar conceptions applicable to individual authorship.At the heart of the argument is the belief that the unavoidableresult of the present definition of joint authorship is denialof reward for authors and artists. Practical significance: This Article argues that the rules ofjoint authorship, as presently configured, do not recognizeintellectual input that should be recognized. The Article defendsthe proposition that this has far-reaching effects on the creativeprocess. It discourages authors from creating or contributingvaluable materials to other authors. More importantly, the flawsinherent in the present definitions of collaboration and contributionin joint authorship contradict the aims of our copyright systemthrough the denial of authorial contributions and withholdingof reward from authors.     

Guilty and innocent suspects’ strategies during police interrogations

Abstract

Deception detection has largely failed to investigate guilty and innocent suspects’ strategies. In this study, mock suspects (n=82) were interrogated by police trainees (n=82) who either were or were not trained in the technique to strategically use the evidence (the SUE technique). Analyses revealed that guilty suspects to a higher degree than innocent suspects applied strategies in order to appear truthful. Guilty suspects reported diverse strategies, while innocent suspects reported the strategy to tell the truth like it had happened, indicating a belief in the visibility of innocence. The realism in the suspects’ expectation about how their veracity was judged was largely dependent on the way in which they had been interrogated. The truth-telling suspects who were interrogated according to the SUE technique were optimistic about being judged as truthful; this optimism was warranted as the vast majority of them were classified as truthful. The SUE technique seems to help (a) spotting guilty suspects without them being aware of it and (b) spotting innocent suspects, and they become aware of it. That innocent (but not guilty) suspects can read how the interrogator views them is advantageous for the investigative process.     

The Need for Regulating Anonymous Remailers

The internet is being used for a number of illicit purposes including: the dissemination of child pornography, cyber-stalking, on-line defamation, copyright infringement and the destruction of trade secrets. Many of these illicit activities have proliferated in recent years because of the increasing use of anonymous remailers. Originally intended to provide anonymity for political dissidents and to assist the discussion of sensitive matters such as abuse or the spread of sexual disease, remailers are now widely used for less noble purposes. A remailer strips the identification marks off an e-mail and replaces it with marks of its own. By combining a chain of remailers with the use of encryption technology, an author can now post messages to Usenet and send e-mail with almost perfect anonymity. Although the majority of anonymous remailers currently exist in Western democracies, the fact that any civil libertarian, commercial operator or criminal can turn their computer into a remailer raises international concern. If strict liability is imposed on remailer operators, it will force these remailers to shut down, only to later reopen in 'fraud-friendly' foreign jurisdictions. This paper will critique the leading academic legal literature regarding anonymous remailers. It will then propose the need for international regulation, while at the same time ensuring the confidentiality concerns of legitimate remailer users.     

E-mail,the Police,and the Canadian Charter of Rights and Freedoms: Retooling Our Understanding of a Reasonable Expectation of Privacy in the Cyber Age

As in other jurisdictions, technological innovation continues to impose burdens on our understanding of the reasonable expectation of privacy in Canada. Recently, the Alberta Court of Queen's Bench was forced to weigh the privacy rights guaranteed under section 8 of the Canadian Charter of Rights and Freedoms against Her Majesty's interest in collecting electronic evidence (in order to facilitate criminal proceedings against an individual who was accused of using e-mail to gain possession of child pornography). For the first time ever in Canada, the Court's analysis focused specifically on the technological aspects of e-mail. Although technological enthusiasts applaud this approach, it has resulted in a decision which, if followed, is sure to render ineffectual the ability of the Canadian Charter of Rights and Freedoms to protect the privacy of Canadian e-mail users against overly intrusive police wire-tap interceptions. Upon a detailed review of this decision (within the context of an overview of the Canadian jurisprudence on unreasonable search and seizure), the author of this paper argues that the traditional test for sanctioning privacy protection must shift away from a merely technological analysis of the actual security offered by the communications medium in question. The author submits that the proper analysis should focus instead on the reasonable Canadian e-mail user's typical understanding and perception of the medium.     

An analysis of contributors to the journal of criminal justice

An analysis of the contributors of publications to the Journal of Criminal Justice was undertaken to evaluate if the initial objectives of the editorial board had, in fact, been achieved. Analysis was based upon authorship, academic discipline of author(s), general topic area, source of article, and specific component area of article.     

Analytical pyrolysis of Streptococcus saliivarius as and aid to identification in bite-mark investigation

The use of pyrolysis mass spectrometry (Py-MS) and statistical analysis of mass spectra is introduced as a method for “finger-printing” strains of Streptococcus salivarius. The objective is to provide correlative evidence regarding the identity of suspects in cases of assault or rape involving bite-marks. The results of the analysis of isolates from two individuals are presented, illustrating the differentiation of S. salivarius at strain level according to the origin of the isolate.     

When Both Sides are Mistaken: Layperson and Legal Professionals’ Misconceptions of Canadian Suspects’ Legal Rights Upon Arrest

Canadian criminal suspects have notably limited access to legal counsel upon arrest compared to suspects in the U.S. Additionally, prior research has shown significant misunderstanding of police warnings informing suspects of their rights upon arrest. This paper presents three studies on Canadians’ comprehension of criminal suspects’ rights upon arrest, with a focus on the right to counsel. Study 1 (N=80) and Study 2 (N=377) examined Canadian layperson’s comprehension, knowledge, and perceptions of legal rights upon arrest. In turn, Study 3 (N=78) investigated Canadian legal professionals’ perceptions of laypersons’ knowledge of those rights. Results from these three studies indicated there is substantial confusion about the right to counsel for Canadian criminal suspects. These results also support previous research demonstrating problems with comprehension of Canadian police cautions. Taken together, the findings of the present research pose significant concern for an increased risk of false confessions from Canadian suspects who enter an interrogation with limited knowledge and understanding of their legal right to counsel.     

Classical Sāṁkhya on the Authorship of the Vedas

The question as to whether the Vedas have an author is the topic of vivid polemics in Indian philosophy. The aim of this paper is to reconstruct the classical Sāṁkhya view on the authorship of the Vedas. The research is based chiefly on the commentaries to the Sāṁkhyakārikā definition of authoritative verbal testimony given by the classical Sāṁkhya writers, for these fragments provide the main evidence (both direct and indirect) for the reconstruction of this view. The textual analysis presented in this paper leads to the following conclusion. According to most classical Sāṁkhya commentaries, the Vedas have no author. Two commentators state directly that the Vedas have no author, and four commentators allude to the authorlessness of the Vedas. Only one commentator seems to hold the opposite view, stating that all the authoritative utterances are based on perception or inference of imperceptible objects by authoritative persons, from which it follows that the Vedas too have an author or authors.     

Police Strategies and Suspect Responses in Real-Life Serious Crime Interviews

This research focuses exclusively on real-life taped interviews with serious crime suspects and examines the strategies used and types of questions asked by police, and suspects’ responses to these. The information source was audio-tape-recorded interviews with 56 suspects. These recordings were obtained from 11 police services across England and Wales and were analysed using a specially designed coding frame. It was found that interviewers employed a range of strategies with presentation of evidence and challenge the most frequently observed. Closed questions were by far the most frequently used, and open questions, although less frequent, were found to occur more during the opening phases of the interviews. The frequency of ineffective question types (e.g. negative, repetitive, multiple) was low. A number of significant associations were observed between interviewer strategies and suspect responses. Rapport/empathy and open-type questions were associated with an increased likelihood of suspects admitting the offence whilst describing trauma, and negative questions were associated with a decreased likelihood.