Scenario Charactersyou Data Security Analyst Allied Technology Syst ✓ Solved

You are a Data Security Analyst at Allied Technology Systems, investigating potential intellectual property theft following the termination of Keith Jackson, a former engineer. After being informed by the Human Resources Director that Jackson may have taken sensitive information, particularly the source code for "Product X," you are tasked with conducting interviews, gathering evidence, and potentially preparing for legal action.

SECTION I: Begin by creating a list of individuals to interview for the investigation, detailing their relationship to the case. Describe the interview setting and outline the process before, during, and after the interview, explaining why each stage is crucial for a successful investigation.

SECTION II: Continue as the Data Security Analyst and summarize what you would like the lab to search for on a thumb drive submitted by Suzanne Fleming, a colleague of Jackson's. Identify locations outside Jackson's workspace where pertinent evidence might be found, noting which places the company can search and which would require police involvement, and why.

Assuming the role of a forensic examiner at Allied Technology Systems, document the steps taken prior to making a forensic image of the thumb drive and explain their significance. Respond to an email from HR regarding the nomination of forensic analysis tools, detailing their capabilities and how they meet criminal justice standards. Explain hash values and their use in the case, then recommend whether to report the crime to law enforcement and justify your decision. Finally, clarify the importance of being qualified as an expert witness and how that differs from being a fact witness. Prepare for trial by addressing potential bias accusations from the prosecutor.

Paper For Above Instructions

The investigation into the termination of Keith Jackson presents a multifaceted scenario for Allied Technology Systems, particularly concerning the protection of intellectual property rights and the handling of sensitive information. The first task at hand is to compile a list of individuals who should be interviewed as part of this investigation. This list should include Randy Capisi, the Information Security Director, who oversees the investigation; Devin Roberts, the Human Resources Director, who initiated the investigation; Jon Dewberry, the Product Engineering Manager overseeing Jackson’s projects; and Suzanne Fleming, Jackson’s fiancé, who possesses potentially crucial evidence in the form of a thumb drive that Jackson gave her.

In considering the interview setting for these discussions, it is essential to choose environments that promote openness and confidentiality. Ideally, interviews should occur in a private room with neutral decoration to minimize distractions and create a relaxed atmosphere that encourages candid responses. Prior to the interview, it is crucial to prepare by reviewing all relevant information about Jackson’s employment, behaviors, and any other pertinent evidence. During the interview, the process should include open-ended questions that allow the interviewees to express their thoughts, while also guiding them gently towards topics of interest to the investigation. Following the interview, documenting the responses immediately is vital to ensure accuracy and preserving details that can impact the investigation. Each of these stages—the pre-interview preparation, the conduct of the interview, and post-interview documentation—are important as they establish a reliable basis for any potential legal proceedings, ensuring that all collected information adheres to standards for admissibility in court.

Next, it is important to detail what information should be examined on the thumb drive presented by Suzanne Fleming. The forensic lab should focus on any files related to "Product X," the company’s essential source code. Additionally, other digital artifacts such as deleted files, timestamps, or any correspondence that indicates intent to transfer confidential information should be scrutinized. This information could prove vital in establishing whether Jackson intended to misappropriate proprietary materials as he transitions to his new employer, thus aiding in the case against him.

Beyond Jackson’s immediate workspace, there are numerous locations where additional evidence might be found. This includes his personal laptop or device, if accessible under company policy, email accounts used for work-related correspondence, and any shared drives or cloud systems utilized for project collaboration. Areas requiring police involvement would include Jackson’s residence or personal properties not owned by the company, as these would necessitate a warrant for a legal search, contingent on the need for criminal evidence. The inclusion of each site is informed by the potential for finding further documents or electronic records that are pertinent to establishing the breadth of his actions concerning intellectual property theft.

As a forensic examiner, my initial action upon receiving the thumb drive involves securely signing and preserving the chain of custody documentation to ensure the integrity of the evidence. Following this, creating a forensic image of the thumb drive is essential to avoid altering the original data during examination. The imaging process maintains the integrity of the evidence since any direct interaction with the original drive may unintentionally change file timestamps or overwrite recoverable data. This procedure also guarantees that the original will remain untouched and available for future legal proceedings, should they arise.

In response to the HR Management’s email, I would recommend three forensic examination tools that align with criminal justice standards and the Daubert Standard for scientific testimony. The tools I would suggest include FTK Imager from AccessData, EnCase from OpenText, and X1 Social Discovery. FTK Imager has comprehensive imaging capabilities, EnCase specializes in file analysis with a proven track record in court, and X1 provides advanced data collection from various data sources. Each tool’s functionalities are paramount in ensuring they meet evidentiary standards and are capable of thorough analysis of data to uncover the truth while preserving legal compliance.

Utilizing hash values plays a significant role in determining the integrity of the files on the thumb drive. A hash value is a unique identifier generated by a cryptographic algorithm that produces a string of characters based on file contents. If the same file exists on the drive in multiple locations or copies, it generates identical hash values, allowing for the determination of duplicity or unauthorized access. In this case, once I computed the hash value of the source code, comparison with that of the thumb drive confirmed its presence, significantly strengthening the evidence against Jackson, as it links him directly to potential theft of proprietary information.

Following the lab report that confirmed the presence of the complete "Product X" source code on Jackson’s thumb drive, it becomes imperative to consider whether to report the crime to law enforcement. I would recommend that the company does report this finding. Although private companies are not universally mandated to report every crime, in cases of intellectual property theft, particularly when the incident could result in serious financial repercussions and harm to the organization, it is both prudent and responsible to alert law enforcement. Reporting the crime also protects the company’s interests and allows for the possibility of criminal charges against Jackson, reinforcing the commitment to uphold ethical business practices.

Upon the determination to prosecute Jackson, the significance of my testimony as an expert witness cannot be underestimated. Unlike a simple fact witness, whose role is only to provide observations made during incidents, as an expert witness, my qualifications, experience, and understanding of digital forensics allow me to interpret complex information for the court. This level of expertise enables me to offer insights and conclusions drawn from the evidence that can influence the jury’s decision-making process. It is essential that my explanations remain clear and accessible to the jury, ensuring that the information conveyed regarding technical evidence is comprehensible and establishes the credibility of the findings.

Finally, should the prosecutor raise questions regarding my potential bias due to my personal blog's content that appears pro-law enforcement, my defense will center on my commitment to integrity in my professional duties. I will assert that my analyses are founded solely on established evidence and practices within the field of digital forensics, and my intention is to pursue the truth without prejudice. My work demonstrated objective results verified through empirical methods, adjustable to scrutiny, and rooted firmly within the standards upheld in my profession.

References

• AccessData. (n.d.). FTK Imager. Retrieved from https://www.accessdata.com/product-download/ftk-imager-version-4-5-0
• OpenText. (n.d.). EnCase Digital Forensics. Retrieved from https://www.opentext.com/products-and-solutions/products/encase-forensic
• X1. (n.d.). X1 Social Discovery. Retrieved from https://www.x1.com/socialdiscovery
• NIST. (2017). Guide to Integrating Forensic Techniques into Incident Response. Retrieved from https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-86.pdf
• Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Law. Academic Press.
• Reith, M., Carr, C., & Gunsch, G. (2002). An Examination of Digital Forensic Models. International Journal of Digital Evidence, 1(3), 1-12.
• Rogers, M. K. (2006). The Need for a Collaborative Approach to Digital Forensics. Journal of Digital Forensics, Security and Law, 1(1), 37-48.
• Goodman, M., & Brenner, S. W. (2002). Lawful Hacking: Using Computer Technology to Pollute the Criminal Environment. Ohio State Journal on Dispute Resolution, 20(2), 189-216.
• Federal Bureau of Investigation. (n.d.). Best Practices for Using Digital Evidence. Retrieved from https://www.fbi.gov/investigate/cyber/internet-crime
• Shinder, D. & Cross, S. (2008). Scene of the Cybercrime: Computer Forensics Handbook. Syngress.