An evaluation of forensic similarity hashes

The fast growth of the average size of digital forensic targets demands new automated means to quickly, accurately and reliably correlate digital artifacts. Such tools need to offer more flexibility than the routine known-file filtering based on crypto hashes. Currently, there are two tools for which NIST has produced reference hash sets–ssdeep and sdhash. The former provides a fixed-sized fuzzy hash based on random polynomials, whereas the latter produces a variable-length similarity digest based on statistically-identified features packed into Bloom filters.This study provides a baseline evaluation of the capabilities of these tools both in a controlled environment and on real-world data. The results show that the similarity digest approach significantly outperforms in terms of recall and precision in all tested scenarios and demonstrates robust and scalable behavior.     

Design and implementation of FROST: Digital forensic tools for the OpenStack cloud computing platform

We describe the design, implementation, and evaluation of FROST—three new forensic tools for the OpenStack cloud platform. Our implementation for the OpenStack cloud platform supports an Infrastructure-as-a-Service (IaaS) cloud and provides trustworthy forensic acquisition of virtual disks, API logs, and guest firewall logs. Unlike traditional acquisition tools, FROST works at the cloud management plane rather than interacting with the operating system inside the guest virtual machines, thereby requiring no trust in the guest machine. We assume trust in the cloud provider, but FROST overcomes non-trivial challenges of remote evidence integrity by storing log data in hash trees and returning evidence with cryptographic hashes. Our tools are user-driven, allowing customers, forensic examiners, and law enforcement to conduct investigations without necessitating interaction with the cloud provider. We demonstrate how FROST's new features enable forensic investigators to obtain forensically-sound data from OpenStack clouds independent of provider interaction. Our preliminary evaluation indicates the ability of our approach to scale in a dynamic cloud environment. The design supports an extensible set of forensic objectives, including the future addition of other data preservation, discovery, real-time monitoring, metrics, auditing, and acquisition capabilities.     

Integrity verification of user space code

We present a novel approach for the construction and application of cryptographic hashes to user space memory for the purposes of verifying the provenance of code in memory images. Several key aspects of Windows behaviour which influence this process are examined in-depth. Our approach is implemented and evaluated on a selection of malware samples with user space components as well as a collection of common Windows applications. The results demonstrate that our approach is highly effective at reducing the amount of memory requiring manual analysis, highlighting the presence of malicious code in all the malware sampled.     

Making the Case: Using a Living and Historic Cultural Universe Big Data System as a Knowledge-Based Foundation for Sustaining and Recapitalizing the Cultural Sector

The cultural sector needs information to support recapitalization efforts. However the majority of existing studies all point to a knowledge gap within the sector: how to evaluate the amount of capital that can be raised. Through big data, we now have the ability to understand the “universe” of support to the cultural sector. In a test employing over two million data cells from 2007 onward for cultural organizations in Charlotte, North Carolina, the author has found evident patterns and predictors for sector support as a foundation for recapitalization, making the case for big data.     

To block or not to block: European approaches to content regulation,and implications for freedom of expression

Based on the limited effectiveness of state laws, and lack of harmonization at international level a number of states started to introduce policies to block access to Internet content and websites deemed illegal which are situated outside their legal jurisdiction. However, blocking policies are not always subject to due process principles, decisions are not necessarily taken by the courts of law, and often administrative bodies or Internet hotlines run by the private sector decide which content or website should be subject to blocking. Therefore, increasingly, the compatibility of blocking action is questioned with regards to the fundamental right of freedom of expression. This article assesses significant developments at the pan-European level with regards to the development, and implementation of Internet content blocking policies. Adaptation of content blocking policies from certain member states of both the European Union and the Council of Europe will be used to assess the nature and implementation of access blocking policies. It will be argued that there could be a breach of Article 10 of the European Convention on Human Rights if blocking measures or filtering tools are used at state level to silence politically motivated speech on the Internet.     

Innovation in the U.S. Service Sector

This paper contributes to ard a better understanding of innovation in the service sector by focusing on the disparate nature of R&D in the U.S. service sector as learned through case studies of the U.S. telecommunications, financial services, systems integration services, and research and development testing services industries. Based on this understanding of the nature and scope of R&D therein, a new policy-oriented model of innovation specific to the service sector is posited. Also, policy recommendations are offered with regard to the public sector’s collection and interpretation of R&D data related to the service sector.      

Protecting the communication: Data protection and security measures under telecommunications regulations in the digital age

This paper aims to provide a comparative overview and evaluation of various legal frameworks for electronic communications security in light of the recent developments in the electronic communications sector. The article also includes an insight on European Union and Turkish legal environment for data protection security in electronic communications sector.     

Blood and bone: body mass,gender and health inequality in nineteenth-century British families

In mid-nineteenth-century Britain, a new institution emerged: the modern prison. Some prisons invested in scales. Upon entry, prisoners were measured and personal details documented. These meticulously compiled records afford a new vantage point from which we can peer into the dynamics of the household. Body measurements – height, weight, and body mass (weight adjusted for height) – connect to both patterns of consumption and health risk. Prison data thus speak to both gender and health inequality in the past. The paper juxtaposes a service economy (Wandsworth near London) with a modern manufacturing sector (Paisley near Glasgow) in order to contrast how economic form and opportunities in the market sector shaped relations and outcomes in the household sector. We find that families bargained over the allocation of resources; that bargaining position was influenced by economic value, mediated by maternal sacrifice; that this was an earner bias rather than gender bias; and that new industrial work for women and children supported a more egalitarian distribution that improved everyone's health status via superior heights and heavier weights. We examine Irish immigrants to assess cultural differences in family behaviour. Finally, the paper offers, for the first time, a detailed interpolation of Waaler's health risk for women.     

South Korea's innovations in data privacy principles: Asian comparisons

Over the last two decades, at least a dozen Asian jurisdictions have adopted significant data privacy (or ‘data protection’) laws. South Korea started to implement such laws in relation to its public sector in the 1990s, then its private sector from 2001, culminating in the comprehensive Personal Information Privacy Act of 2011. Internationally, there have been two stages in the development of data privacy principles (the common core of such laws), the first typified by the OECD's data protection Guidelines of 1981, and the second typified by the European Union data protection Directive of 1995, with a third stage currently under development.     

Regional Unemployment in Transitional China: A Theoretical and Empirical Analysis

The purpose of this paper is to explain the pattern of regional unemployment in transitional China. A model is developed to explore how urban unemployment in the provinces is influenced by peasants' wages, formal sector wages, and the size of the formal sector. Evidence from panel data suggests that a significant indicator of high unemployment rates is greater Urban–Rural Income Inequality within the province. The hypothesis is that the urban–rural income gap produces migration, and more rural migrants substitute for urban workers, causing further urban unemployment. Since the economic reforms began in 1978, the non-state owned enterprises have been carrying an increasing weight in the economy, and they have contributed significantly to the rapid economic growth of China. Empirical evidence shows that economic reforms have reduced unemployment. The provinces that are still heavily dependent on the state sector are therefore more likely to experience higher unemployment.     

From shared cost to block funding and beyond: the politics of health insurance in Canada

This paper takes as its starting point recent major changes in arrangements between the federal and provincial government in Canada concerning the sharing of costs for health insurance programs. The switch from a shared cost (conditional grant) to a modified block funding system was motivated by federal desires to limit and make predictable their expenditures, by provincial desires to increase the flexibility of their allocation of funds and by a mutual desire to limit any growth of health care costs as a proportion of GNP. Concerns related directly to improving medical care delivery were insignificant The changes will effectively centralize responsibility for program financing and program delivery, thus providing a powerful incentive for provincial governments to apply very strong measures to control costs. For reasons largely external to the relationship between public sector insurers and the suppliers of medical services, these attempts are unlikely to be successful in the short run. The probable impact of this difficulty on government and members of the health care delivery system is assessed.     

Singapore's Personal Data Protection legislation: Business perspectives

As global digitalisation of information and interconnecting technologies along with new marketing practices and business processes vastly increase the opportunities for data collection, storage, usage and delivery, there is a corresponding increase in consumer expectations of data privacy. These expectations must be met if business organisations are to promote consumer trust and confidence and maintain their overall competitiveness in a global market. It goes without saying that information is the most valuable business asset and “privacy is good business and information can be the basis of bigger business”. The need to protect data privacy has long been recognised and implemented by major trading nations. Surprisingly, Singapore as a financial centre and nation aspiring to be a trusted data hosting hub has been slow in enacting specific data protection laws. The first piece of legislation that has emerged is a light-touch baseline framework applicable to all organisations except the public sector. This article considers the new legislation from the business perspective and the implications for private sector business organisations facing the challenges of compliance.     

Ready to leave the ivory tower?: Academic scientists’ appeal to work in the private sector

This study investigates the factors that shape the attitudes of scientists toward starting their own business or working in a private sector firm. The analysis is based on data collected from scientists working in the German Max Planck Society, a research institution devoted to basic science. We find that the scientists’ attractiveness of working in a private sector firm or of starting their own business differ considerably according to their academic discipline and the self-reported commercial potential of their research. The ability to take risks, prior work experience in private firms, and personal experience in cooperating with industry lead to a positive attitude towards switching to private sector employment or entrepreneurship. Strong willingness to freely distribute research findings is related to a low appeal of private sector work.     

Fast indexing strategies for robust image hashes

Similarity preserving hashing can aid forensic investigations by providing means to recognize known content and modified versions of known content. However, this raises the need for efficient indexing strategies which support the similarity search. We present and evaluate two indexing strategies for robust image hashes created by the ForBild tool. These strategies are based on generic indexing approaches for Hamming spaces, i.e. spaces of bit vectors equipped with the Hamming distance. Our first strategy uses a vantage point tree, and the second strategy uses locality-sensitive hashing (LSH). Although the calculation of Hamming distances is inexpensive and hence challenging for indexing strategies, we improve the speed for identifying similar items by a factor of about 30 with the tree-based index, and a factor of more than 100 with the LSH index. While the tree-based index retrieves all approximate matches, the speed of LSH is paid with a small rate of false negatives.     

Competition in the Netherlands and Belgium: Service sector evidence

This paper examines competition in the Dutch and Belgian service sector for the period 1995–1999. The paper explores the link between firm profitability and market structure, and provides evidence of a non-optimal functioning of both markets. While analysis reveals the existence of a market sector effect in both countries, this effect is larger in the Dutch sample than in the Belgian sample, implying that the Dutch service sector is less competitive than the Belgian service sector. An analysis of the market friendliness of regulations in both countries does not provide a comprehensive explanation for this finding. JEL Classification: L12 · L16 · L51 · L80     

Differences between voluntary and public organizations: the behavior of hospitals in England and Wales

This study confronts the following questions: what are the conditions under which a society decides to do things in the public and voluntary nonprofit sectors, and in what ways do organizations behave differently, depending on whether they are in the public or the voluntary nonprofit sector? To address these questions, the study focuses on English and Welsh hospitals during the twentieth century but prior to the National Health Service. The study argues that as long as the sources of funding for public and voluntary organizations diverge, their behavior will diverge. Because English and Welsh voluntary hospitals prior to the National Health Service were heavily dependent on the voluntary sector for funding and the public hospitals were primarily dependent on the public sector for their funding, the data set is especially valuable for observing how divergent sources of funding influence the behavior of organizations.     

UK further education sector journey to compliance with the general data protection regulation and the data protection act 2018

The Further Education sector provides training and qualifications to 2.2million young people and adults annually and in the process collect a wealth of data which must be properly managed to ensure it is processed in a fair and transparent manner, maintaining compliance with good information governance and data protection legislation. This article shares the findings of a study which explored the content of General Data Protection Regulation action plans, first hand accounts from data practitioners and the views of students as provides embraced the new legislation.The article demonstrates how a sector which fills the void between schools and universities is unique in the challenges they face when ensuring compliance with data protection laws. These challenges include the application of legislation, noting key differences between the nations of the United Kingdom, and the moral duties placed upon the provider by parents who expect open dialogue with the education provider, consistent as happened with lower levels of education. This must be balanced with the student's right to data privacy and control over who can access their educational records .     

The exploitation of Business Register data from a public sector information and data protection perspective: A case study

Business Registers (BRs) are a very important information resource for investors, creditors, financial institutions and public authorities. The possibility to aggregate and interconnect these data at a European level could enhance the transparency of companies towards those actors and add a great deal of value to the raw Business Register data. The European BRITE project intended to provide adequate tools to meet these demands. BRITE will provide easier access and cross-border interoperability of Business Register data throughout Europe. On the other hand, the processing of BR data within the BRs and BRITE triggers several important European legislations such as the Data Protection Directive and the Directive on the re-use of public sector information. In this paper, the processing of BR data will be analysed from the perspective of both data protection and public sector information laws, analysing as well the relation between both regulations. Do these regulations strike an optimal balance between the interests of private data vendors to re-use BR data and enhance business transparency and the need to protect the personal data of natural persons?     

Hong Kong's data breach notification scheme: From the stakeholders’ perspectives

Data breach notification laws have been enacted in an increasing number of economies around the world. These laws establish the requirement for notice in the event of a data breach incident. Although, there are a number of reasons for requiring data breaches to be notified, the primary objective of the laws is to regulate organizations’ data security practices in order to protect the data privacy of its customers. In so doing, the data reporting obligations promote accountability, transparency and trust, thereby improving the overall organizational data security environment. Opinions are, however, divided amongst various private sector stakeholders on the issue of mandatory data breach notification. Drawing on the interviews with 24 private sector representatives with interest in data breach issues, this article documents and examines their position on the appropriate regulatory approach for data breach notification in Hong Kong .     

Electrically conductive adhesives,thermally conductive adhesives and UV adhesives in data extraction forensics

Recent publications underline the interest of using polymers in microelectronics (Li and Wong, 2006a; Cui et al., 2014). Polymers are the ideal interconnect alternative to solder materials containing lead. Electrically Conductive Adhesives [ECAs] (Li and Wong, 2006b), Thermally Conductive Adhesives (TCAs) (Felba et al., 2011) and UV Adhesives (UVAs) (Asif et al., 2005) mainly consist of a polymeric resin (epoxy, silicon, polyurethane or polyimide) that provides physical and mechanical properties such as adhesion, mechanical strength while containing metal fillers (silver, gold, nickel or copper) that conduct electricity (Luo et al., 2016). Currently it is possible to find really cheap polymeric resin. Using these resins for digital forensic purposes is the focus of this paper, that we demonstrate in a hardware reverse engineering prototype case study.When considering new mobile devices, such as secure phones, it is often necessary to spy communication and perform numerous tests on the memory (e.g. by changing some bytes) to understand or modify the implemented security mechanisms (manipulate system time, locate password hashes, observe artefacts of implemented security algorithms, etc.). Traditional techniques use either laser attacks/probing (chip on) or soldering/read/re-soldering (chip off/on) (Heckmann et al., 2016, Jongh, 2014). These two techniques are unsuitable for repeated operations requiring many readings/changes/injections. This paper describes a concrete case study using adhesive properties complementary to chip on and chip off methods.We present the steps using different properties of adhesives (ECA, TCA, UVA) that we will lead to the realisation of a prototype particularly suitable for the repeating of the read phases/changes/injections necessary for reverse engineering secure mobile devices.