Automated identification of installed malicious Android applications

Increasingly, Android smartphones are becoming more pervasive within the government and industry, despite the limited ways to detect malicious applications installed to these phones' operating systems. Although enterprise security mechanisms are being developed for use on Android devices, these methods cannot detect previously unknown malicious applications. As more sensitive enterprise information becomes available and accessible on these smartphones, the risk of data loss inherently increases. A malicious application's actions could potentially leave sensitive data exposed with little recourse. Without an effective corporate monitoring solution in place for these mobile devices, organizations will continue to lack the ability to determine when a compromise has occurred. This paper presents research that applies traditional digital forensic techniques to remotely monitor and audit Android smartphones. The smartphone sends changed file system data to a remote server, allowing for expensive forensic processing and the offline application of traditional tools and techniques rarely applied to the mobile environment. The research aims at ascertaining new ways of identifying malicious Android applications and ultimately attempts to improve the state of enterprise smartphone monitoring. An on-phone client, server, database, and analysis framework was developed and tested using real mobile malware. The results are promising that the developed detection techniques identify changes to important system partitions; recognize file system changes, including file deletions; and find persistence and triggering mechanisms in newly installed applications. It is believed that these detection techniques should be performed by enterprises to identify malicious applications affecting their phone infrastructure.     

民事诉讼发回重审制度之探讨

我国民事诉讼发回重审制度的设计和运作尚存在比较多的问题。该制度的设计与运作应当以维护当事人的审级利益,保障当事人的听审请求权,维护当事人的系争外利益,尊重当事人的程序选择权为指导思想。基此,在完善我国民事诉讼发回重审制度时,应当重新设定发回重审的法定事由,增设发回重审的条件,赋予当事人程序选择权,规定发回重审裁定中判断理由的法律效力,明确界定重审的审理范围,限制发回重审的次数。     

The Intensification and Bifurcation of Surveillance in British Criminal Justice Policy

This paper explores the relevance and applicability of recent theoretical developments in surveillance studies in the context of contemporary British criminal justice policy. It will be argued that surveillance now occupies a privileged position in official policy. In a raft of new policy initiatives undertaken either as part the general project to modernise the criminal justice system or in response to particular crises, the surveillant solution occupies the central stage. Thus, whether it be in response to anxieties over sex offenders, failures of social services in protecting children at risk, or the management of the prison population, for example, the policy response has been to increase the surveillance capacity of the state. In particular, in line with the new penology thesis we are witnessing an expansion of the generalised surveillance capacity, in relation to all citizens, which may be characterised as passive and reactive. Simultaneously, vestiges of the old criminology remain as an officially designated ‘hard core’ of persistent or problematic offenders subject to the full panoply of surveillance techniques, which are proactive, extensive and intrusive. Thus, we are witnessing both an intensification and a bifurcation of surveillance practice. This paper was prepared for the European Journal on Criminal Policy and Research special edition on Fear vs. Freedom post 9/11-The European Perspective.     

行政协议变更、解除制度的整合与完善

将民事合同之情势变更、法定解除制度参照适用于行政协议,应当如何与行政主体单方变更解除制度相互衔接?结合既有规范及人民法院审判实践,可以看到,当发生协议相对人根本违约或遭遇不可抗力及情势变更时,缔约行政主体在原则上皆应参照适用民事合同之情势变更、法定解除制度;而仅在缔约行政主体所不能预见、不能避免之客观事变乃源于公共利益需求新变化,并且涉案具体情形满足行政协议下单方高权行为之行使条件时,缔约行政主体才可以适用行政协议单方变更解除制度。为了完善两项制度的衔接,未来还需提升单方变更解除行为对协议相对人及社会公众的可预期性,并完备缔约行政主体在行政协议中主张情势变更的配套制度。     

Open or closed meetings? Explaining nonstate actor involvement in the international climate change negotiations

When do states allow nonstate actors (NSAs) to observe negotiations at intergovernmental meetings? Previous studies have identified the need for states to close negotiations when the issues under discussion are sensitive. This paper argues that sensitivity alone cannot adequately explain the dynamic of closing down negotiations to observers. Questions that have received little attention in the literature include which issues are considered sensitive and how the decision is made to move the negotiations behind closed doors. This paper examines the practices of NSA involvement in climate diplomacy from three analytical perspectives: functional efficiency, political dynamics, and historical institutionalism. Based on interviews and UNFCCC documents, this paper suggests that to understand the issue of openness in negotiations, institutional factors and the politics of NSA involvement need to be better scrutinized. The paper shows that each perspective has particular advantages when analyzing different dimensions of the negotiations, with implications of how we understand the role of NSAs in global environmental governance.     

An Evidence‐based Forensic Taxonomy of Windows Phone Dating Apps

Advances in technologies including development of smartphone features have contributed to the growth of mobile applications, including dating apps. However, online dating services can be misused. To support law enforcement investigations, a forensic taxonomy that provides a systematic classification of forensic artifacts from Windows Phone 8 (WP8) dating apps is presented in this study. The taxonomy has three categories, namely: Apps Categories, Artifacts Categories, and Data Partition Categories. This taxonomy is built based on the findings from a case study of 28 mobile dating apps, using mobile forensic tools. The dating app taxonomy can be used to inform future studies of dating and related apps, such as those from Android and iOS platforms.     

A study on the forensic mechanisms of VoIP attacks: Analysis and digital evidence

This paper discusses the use of communication technology to commit crimes, including crime facts and crime techniques. The analysis focuses on the security of voice over Internet protocol (VoIP), a prevention method against VoIP call attack and the attention points for setting up an Internet phone. The importance of digital evidence and digital forensics are emphasised. This paper provides the VoIP digital evidence forensics standard operating procedures (DEFSOP) to help police organisations and establishes an experimental platform to simulate phone calls, hacker attacks and forensic data. Finally, this paper provides a general discussion of a digital evidence strategy that includes VoIP for crime investigators who are interested in digital evidence forensics.     

An examination into Trillian basic 3.x contact identification

With the advent of new legislation in the United Kingdom – as well as several high-profile criminal cases – the issue of Internet grooming has been the subject of much recent focus. Of particular interest to the forensic examiner is the ability to trace back from a known suspect's computer system to identify contact with his alleged victims. Specifically, when an allegation of grooming is made, one of the first things the examiner should do is to determine that the suspect's computer system was used to contact the informant's account in the first place. This a strong evidential link between victim and suspect and clearly demonstrates that the suspect was responsible for that contact rather than a third party who may have taken control of the suspect's chat account.     

Perceptions of Remote and Walk‐In Service Delivery in Family Law Cases

In recent years, the number of litigants representing themselves without legal counsel has increased across the United States. Courts have responded by creating programs and services to help litigants represent themselves. Self‐help centers nationwide use different models to deliver legal advice and information to unrepresented litigants. Some offer court‐based, walk‐in self‐help centers. Others provide services remotely via phone, web, email, video conferencing, and live chat. In Maryland, self‐help center services are offered at walk‐in centers and remotely by phone and live chat. This article examines litigants' perceptions of in‐person and remote delivery of legal advice and information on family law matters. Results revealed that all three service delivery methods have high satisfaction rates, but chat users were less likely to feel as though they knew what to do next. They were also less optimistic about their case than were phone or in‐person users.     

Unmanned aerial vehicles: A preliminary analysis of forensic challenges

As unmanned aerial vehicles have become more affordable, their popularity with the general public and commercial organisations has seen significant growth in recent years. Whilst remaining a device for both the hobbyist and aircraft-enthusiast to enjoy, they are now also used for carrying out activities such as law enforcement surveillance, agricultural maintenance, acquiring specialist movie and sports event footage along with search and seizure activities. Conversely, despite maintaining many legitimate uses, there are also increasing media reports of unmanned aerial vehicle technology being abused, ranging from physical assaults due to negligent flights to breaches of Civil Aviation Authority Air Navigation Regulations, requiring a forensic analysis of these devices in order to establish the chain of events. This article presents an introductory discussion of unmanned aerial vehicle analysis and provides the results of a digital forensic investigation of a test Parrot Bebop unmanned aerial vehicle. Directions for the acquisition and analysis of the device's internal storage are provided along with an interpretation of on-board flight data, captured media and operating system. Further, as the device can be controlled via Android and iOS devices using the application FreeFlight3, forensic analysis of these devices is also presented. Results showed the ability to recover flight data from both the unmanned aerial vehicle and controller handsets along with captured media, however problems exist with establishing the definitive owner of the device, particularly if a user had abandoned it at the scene of a crime.     

Forensic carving of network packets and associated data structures

Using validated carving techniques, we show that popular operating systems (e.g. Windows, Linux, and OSX) frequently have residual IP packets, Ethernet frames, and associated data structures present in system memory from long-terminated network traffic. Such information is useful for many forensic purposes including establishment of prior connection activity and services used; identification of other systems present on the system’s LAN or WLAN; geolocation of the host computer system; and cross-drive analysis. We show that network structures can also be recovered from memory that is persisted onto a mass storage medium during the course of system swapping or hibernation. We present our network carving techniques, algorithms and tools, and validate these against both purpose-built memory images and a readily available forensic corpora. These techniques are valuable to both forensics tasks, particularly in analyzing mobile devices, and to cyber-security objectives such as malware analysis.     

Outsourcing,Discretion, and Administrative Justice: Exploring the Acceptability of Privatized Decision Making

This study explores what happens to administrative justice and to the acceptability of frontline decisions in privatized and marketized models of service. Through the case study of privatized welfare‐to‐work in Israel, it shows the fundamental tension between outsourced discretion and traditional conceptions of administrative justice in which the trustworthiness of decisions relies on the idea that decision makers have no personal interest in the outcome of their decisions. It finds that in the Israeli case, contractors' financial interests were widely perceived as putting their professionals into a conflict of interest, thereby undermining trust in their decisions. At the same time, the study finds the program's managerial performance mechanisms did not provide an alternative legitimacy argument for the acceptability of decisions. The study also analyzes the ways policy makers reconstructed the decision‐making systems to regain public acceptance of frontline decisions, while discussing both the potential and the limits of legitimizing outsourced discretion in such complex public services.     

Services of General Interest in EC Law: Matching Values to Regulatory Technique in the Public and Privatised Sectors

All the European Union Member States have long traditions of state activity in providing key services (such as the utilities, health and education) to their citizens and underpinning both such direct provision and provision of services by non‐state actors with certain administrative or legal guarantees. In European Community doctrines they are referred to as ‘services of general interest’ within which is a narrower class of ‘services of general economic interest’. The diverse national public service traditions have been challenged both by the requirements of the single market and by other pressures such as fiscal crisis and broader public sector reform. This article examines the means by which services to which special principles should be applied can be identified and focuses on the range of sometimes contradictory values denoted by the term ‘services of general interest’, examining the range of regime types (based on hierarchical, competition‐based and community forms) by which those values might be pursued. The concluding section suggests that the matching of values to techniques should not be made according to the importance of the values to be pursued, but rather by reference to which techniques are likely to be effective given the configuration of interests and capacities and existing culture within the target domain.     

Public Interest Law Organizations and the Two‐Tier System of Access to Justice in the United States

Public interest law organizations (PILOs) are important institutions for providing access to justice in the United States. How have political, economic, and institutional factors shaped PILOs? How do PILOs vary in the services they offer and in their geographical location relative to poverty and population in the United States? This article investigates these questions by combining original survey data from a representative sample of public interest law organizations with GIS data on population and poverty. We find that the presence of a PILO is positively related to political progressiveness and population at the county level, but negatively related to the concentration of poverty. Our analysis reveals a two‐tier system of public interest representation in which national organizations engage in a variety of social change strategies, whereas local and regional organizations utilize more limited strategies and depend more on governmental funding. These patterns have implications for access to justice in the United States today.     

Clinical practice guidelines: the warped incentives in the U.S. healthcare system

The healthcare system is sick. The players are incentivized to maximize their own benefit and externalize their costs onto the other parties. This paper examines the warped incentives that underlie the system. The tort system, lacking expertise and slow to adapt, is unable to overcome cognitive biases to adequately solve the problems. Clinical practice guidelines could pose a solution, but not as they are currently developed. Guidelines promulgated by healthcare associations are infected by a web of conflicts of interest with every player in the industry. Government agencies, and their revolving doors, are underfunded and also subject to the industry's web of conflicts. Even if adequate guidelines could consistently be produced, state legislatures and courts have been unwilling and unable to substantially incorporate guidelines into the legal landscape. Lastly, this article proposes a private regulation regime that could be a solution which would align all of the players' incentives to society's interests.     

Loose‐Lipped Mobile Device Intelligent Personal Assistants: A Discussion of Information Gleaned from Siri on Locked iOS Devices

The forensic analysis of mobile handsets is becoming a more prominent factor in many criminal investigations. Despite such devices frequently storing relevant evidential content to support an investigation, accessing this information is becoming an increasingly difficult task due to enhanced effective security features. Where access to a device's resident data is not possible via traditional mobile forensic methods, in some cases it may still be possible to extract user information via queries made to an installed intelligent personal assistant. This article presents an evaluation of the information which is retrievable from Apple's Siri when interacted with on a locked iOS device running iOS 11.2.5 (the latest at the time of testing). The testing of verbal commands designed to elicit a response from Siri demonstrate the ability to recover call log, SMS, Contacts, Apple Maps, Calendar, and device information which may support any further investigation.     

Professionals' Contribution to the Legislative Process: Between Self,Client, and the Public

How may professionals be made to contribute to legislative processes so that their expertise redounds to the public interest, despite the legislative product being likely to have a negative impact on their clients' wealth? Drawing on a case study of the legislative process that gave birth to Israel's recent (2002–2008) trusts taxation regime, based on five years of participant observation among the trust professional community, I find that to obtain the benefit of private‐sector professionals' expertise under such circumstances, government should have legislation drafted in a dispassionate, exclusive environment of experts rather than in the political arena; it should build professionals' trust in government by adopting an explicitly collegial approach; it should focus reform efforts on elements of the existing law so clearly inequitable as to make a refusal to contribute difficult to justify; and take care that the new regime creates a compliance practice lucrative enough to compensate for any loss to professionals consequent on its enactment. Once professionals' interests are suitably safeguarded, their loyalty to clients appears surprisingly brittle and government can successfully combine with them in the public interest.     

Constitutional considerations of the escrowed encryption standard

In the physical world, spaces are tangibly defined to secure privacy. The cyberspace equivalent of sealed envelopes and locked doors is encryption. Encryption uses hardware and/or software to ensure that electronic communication is not intercepted by unwelcome and unintended parties. The technology allows communicators transmitting across telephone lines to encode conversations or data.

Sophisticated encryption technology protects legitimate privacy, but it may also cloak illegal activities by obstructing electronic surveillance by law enforcement agencies. The Escrowed Encryption Standard is a federal plan to protect telephone and computer communication from illegal interception and allow government access to these communications for surveillance. This article examines the plan's possibly adverse impacts on constitutional rights, with specific attention to the First, Fourth and Fifth amendments.     

The economics of notaries

In civil law legal systems, notaries fulfill two crucial roles, acting as both law enforcers and court officers, and as facilitators and enforcers of private transactions. In these countries, notaries achieve economies of scope by simultaneously providing private and public services and substituting both parties' lawyers. This arrangement is subject, however, to serious conflicts of interest that could prejudice the provision of public services that have attributes of externalities, as well as the notary's independence from all parties to the transaction. This paper shows how this notary system may be efficient in this context. Focusing on Spanish notaries, it analyzes the legal and economic nature of the services, the incentives that control their provision, and the cost in terms of competitive restraints that could be generated by the organizational patterns making up such incentives. Supporting empirical evidence is also provided.