WEBVTT

1
00:00:00.000 --> 00:00:04.260
Hello, and welcome back to
the Computer Forensics Path,

2
00:00:04.260 --> 00:00:09.075
Course 5, digital evidence
and legal issues.

3
00:00:09.075 --> 00:00:11.505
In this course,
we're going to cover

4
00:00:11.505 --> 00:00:13.680
legal issues that pertain to

5
00:00:13.680 --> 00:00:15.780
the admissibility
of our evidence,

6
00:00:15.780 --> 00:00:17.190
whether our evidence
would be allowed

7
00:00:17.190 --> 00:00:18.615
into a court of law.

8
00:00:18.615 --> 00:00:20.535
We're also going to talk about

9
00:00:20.535 --> 00:00:24.480
some difference between
civil law and criminal law.

10
00:00:24.480 --> 00:00:28.950
Criminal law talks about
violations of a state,

11
00:00:28.950 --> 00:00:31.425
local, or federal statute.

12
00:00:31.425 --> 00:00:34.710
The penalties are very
high for violating those.

13
00:00:34.710 --> 00:00:36.370
A person can lose their freedom.

14
00:00:36.370 --> 00:00:38.465
We're also going to
talk about civil law,

15
00:00:38.465 --> 00:00:41.030
which usually pertains
to cases involving

16
00:00:41.030 --> 00:00:44.165
property rights and
monetary damages.

17
00:00:44.165 --> 00:00:46.990
We're also going to
cover ethical issues.

18
00:00:46.990 --> 00:00:49.490
Ethics is a set of values

19
00:00:49.490 --> 00:00:51.260
which are going to
promote the safety and

20
00:00:51.260 --> 00:00:52.930
welfare in our society.

21
00:00:52.930 --> 00:00:55.400
These are things that are
taken very seriously in

22
00:00:55.400 --> 00:00:58.310
our profession because if
you violate your ethics,

23
00:00:58.310 --> 00:01:01.200
you will lose all credibility
in your profession,

24
00:01:01.200 --> 00:01:04.895
and you also make the
profession as a whole look bad.

25
00:01:04.895 --> 00:01:09.320
The first thing we're going
to talk about in Module 1 is

26
00:01:09.320 --> 00:01:14.050
applicable laws and
ethics. Search authority.

27
00:01:14.050 --> 00:01:16.130
This might be one of the
most important things we're

28
00:01:16.130 --> 00:01:18.500
going to talk about
in this entire path.

29
00:01:18.500 --> 00:01:22.700
Search authority is what gives
you the right to perform

30
00:01:22.700 --> 00:01:24.725
your examination on the evidence

31
00:01:24.725 --> 00:01:26.980
that you have provided to you,

32
00:01:26.980 --> 00:01:29.160
or if you go out and
seize it yourself,

33
00:01:29.160 --> 00:01:30.470
it's the authority under which

34
00:01:30.470 --> 00:01:32.885
you're seizing that evidence.

35
00:01:32.885 --> 00:01:36.020
Our search authority can
come from things like

36
00:01:36.020 --> 00:01:38.605
warrants, court
orders, subpoenas,

37
00:01:38.605 --> 00:01:41.615
if we have real-time
interception authority,

38
00:01:41.615 --> 00:01:44.105
like in a wiretap, which
we'll talk more about.

39
00:01:44.105 --> 00:01:46.820
It can come from our
state and federal laws.

40
00:01:46.820 --> 00:01:48.875
If you work in the
private sector,

41
00:01:48.875 --> 00:01:51.065
it could come from your employer,

42
00:01:51.065 --> 00:01:55.970
company policy, or it can
also come from consent,

43
00:01:55.970 --> 00:01:59.065
which we will also get
into much later on.

44
00:01:59.065 --> 00:02:00.825
Search and seizure.

45
00:02:00.825 --> 00:02:03.980
The general outline for all
laws governing search and

46
00:02:03.980 --> 00:02:07.220
seizure come from
the Fourth Amendment

47
00:02:07.220 --> 00:02:09.275
to the US Constitution.

48
00:02:09.275 --> 00:02:10.910
Below on the slide you can

49
00:02:10.910 --> 00:02:14.450
see that the Fourth Amendment
is written out there.

50
00:02:14.450 --> 00:02:16.220
This is the right of people to be

51
00:02:16.220 --> 00:02:18.740
secure in their persons,
houses, papers,

52
00:02:18.740 --> 00:02:21.320
and effects against unreasonable,

53
00:02:21.320 --> 00:02:25.275
and that's a very important
word, search and seizure.

54
00:02:25.275 --> 00:02:30.020
This shall not be violated
without a warrant.

55
00:02:30.020 --> 00:02:33.650
No warrant should be
issued except under

56
00:02:33.650 --> 00:02:36.020
probable cause and that's

57
00:02:36.020 --> 00:02:39.100
going to be supported by some
type of written document.

58
00:02:39.100 --> 00:02:43.160
It's going to have to
describe the place

59
00:02:43.160 --> 00:02:47.495
to be searched and the person
or thing to be seized.

60
00:02:47.495 --> 00:02:49.325
We'll see that as we go through.

61
00:02:49.325 --> 00:02:51.130
That is very important.

62
00:02:51.130 --> 00:02:53.630
Again, the Fourth
Amendment, like we said,

63
00:02:53.630 --> 00:02:54.890
at its most basic level,

64
00:02:54.890 --> 00:02:56.150
does require a warrant.

65
00:02:56.150 --> 00:02:59.300
But there are several exceptions
to the Fourth Amendment.

66
00:02:59.300 --> 00:03:01.850
The ones we're going to
talk about right now,

67
00:03:01.850 --> 00:03:03.290
we're going to talk
about consent.

68
00:03:03.290 --> 00:03:08.085
Somebody can give you consent
to search their property.

69
00:03:08.085 --> 00:03:13.115
We can also have a search
incident to a lawful arrest.

70
00:03:13.115 --> 00:03:15.230
That is when somebody
is placed under

71
00:03:15.230 --> 00:03:18.395
arrest by a law
enforcement officer.

72
00:03:18.395 --> 00:03:20.030
There are certain
things that can be

73
00:03:20.030 --> 00:03:22.525
searched as a result
of that arrest.

74
00:03:22.525 --> 00:03:24.520
Plain view is an exception.

75
00:03:24.520 --> 00:03:27.230
That means if you are
lawfully in a place,

76
00:03:27.230 --> 00:03:28.865
you have to be there lawfully,

77
00:03:28.865 --> 00:03:32.090
and you see something that
is obviously contraband,

78
00:03:32.090 --> 00:03:34.024
something that's
illegal to possess,

79
00:03:34.024 --> 00:03:36.140
or something that relates

80
00:03:36.140 --> 00:03:37.910
to a crime you're investigating,

81
00:03:37.910 --> 00:03:39.920
you can seize that and it

82
00:03:39.920 --> 00:03:42.365
will be admissible
in a court of law.

83
00:03:42.365 --> 00:03:46.400
Stop and frisk, this mainly
pertains to law enforcement,

84
00:03:46.400 --> 00:03:49.470
is an exception to
the Fourth Amendment.

85
00:03:49.470 --> 00:03:52.895
It stems from a federal case
called Terry versus Ohio,

86
00:03:52.895 --> 00:03:54.800
where somebody was stopped,

87
00:03:54.800 --> 00:03:55.970
and they were patted down,

88
00:03:55.970 --> 00:03:59.719
and they felt an object
in their clothing,

89
00:03:59.719 --> 00:04:03.005
and it ended up being a firearm.

90
00:04:03.005 --> 00:04:05.570
But he matched the description of

91
00:04:05.570 --> 00:04:07.640
the person that they
were looking for who

92
00:04:07.640 --> 00:04:10.330
had just committed a shooting.

93
00:04:10.330 --> 00:04:13.090
Automobile exception is also one.

94
00:04:13.090 --> 00:04:14.780
That's because automobiles or

95
00:04:14.780 --> 00:04:17.435
motor vehicles are very movable.

96
00:04:17.435 --> 00:04:22.010
There is a certain
amount of exception

97
00:04:22.010 --> 00:04:24.005
there because they're mobile

98
00:04:24.005 --> 00:04:26.240
and you can lose the evidence.

99
00:04:26.240 --> 00:04:27.560
The evidence could drive

100
00:04:27.560 --> 00:04:29.680
away and you may not be
able to get it back.

101
00:04:29.680 --> 00:04:30.980
There are certain parts of

102
00:04:30.980 --> 00:04:33.715
an automobile that you
are allowed to search.

103
00:04:33.715 --> 00:04:35.895
Exigent circumstances.

104
00:04:35.895 --> 00:04:38.010
This is one that
will pertain to us

105
00:04:38.010 --> 00:04:41.280
as a forensic examiner sometimes.

106
00:04:41.280 --> 00:04:47.675
That's when something is
an emergency basically.

107
00:04:47.675 --> 00:04:50.510
It could be you're
pinging a phone of

108
00:04:50.510 --> 00:04:53.942
somebody who is threatening
to commit suicide

109
00:04:53.942 --> 00:04:56.800
or maybe they took a hostage and

110
00:04:56.800 --> 00:04:59.625
they're fleeing the
scene, a missing child,

111
00:04:59.625 --> 00:05:02.735
you can sometimes do some type of

112
00:05:02.735 --> 00:05:05.680
electronic real-time interception
without a warrant as

113
00:05:05.680 --> 00:05:09.005
part of exigent circumstances
in those cases.

114
00:05:09.005 --> 00:05:11.770
Banners: Banners are things

115
00:05:11.770 --> 00:05:14.110
you'll see a lot of times
when you would go to

116
00:05:14.110 --> 00:05:19.755
certain websites or when you
sign up for social media,

117
00:05:19.755 --> 00:05:22.015
in there is something that

118
00:05:22.015 --> 00:05:25.090
says you do not have
a right to privacy,

119
00:05:25.090 --> 00:05:29.125
that your data and your
information can, will be shared.

120
00:05:29.125 --> 00:05:33.575
Banners can also be
things that are posted.

121
00:05:33.575 --> 00:05:36.040
If you walk into a prison,

122
00:05:36.040 --> 00:05:37.300
you'll most often see

123
00:05:37.300 --> 00:05:40.250
that all conversations
are recorded.

124
00:05:40.250 --> 00:05:43.235
It can also be something
by your employer,

125
00:05:43.235 --> 00:05:45.160
there may be a banner
on your page that

126
00:05:45.160 --> 00:05:48.760
says that your communications
are not private.

127
00:05:49.110 --> 00:05:52.690
This can also give people
the authority to monitor

128
00:05:52.690 --> 00:05:55.400
real-time access stored files.

129
00:05:55.400 --> 00:05:58.165
They can provide certain
information to law enforcement.

130
00:05:58.165 --> 00:06:01.440
We see that with Internet
service providers lot of times.

131
00:06:01.440 --> 00:06:04.115
If you're sharing elicit images,

132
00:06:04.115 --> 00:06:06.700
photos of child pornography

133
00:06:06.700 --> 00:06:08.390
or things you
shouldn't be sharing,

134
00:06:08.390 --> 00:06:10.115
you have that stored on

135
00:06:10.115 --> 00:06:13.415
your Google Drive
or your Dropbox,

136
00:06:13.415 --> 00:06:16.090
then you do not have
a right to privacy.

137
00:06:16.090 --> 00:06:17.560
Those things can be reported to

138
00:06:17.560 --> 00:06:21.580
the police or you can
consent to these things.

139
00:06:21.580 --> 00:06:23.410
A lot of times the
agreements you sign with

140
00:06:23.410 --> 00:06:28.195
your Internet service provider
or Facebook, Instagram,

141
00:06:28.195 --> 00:06:30.770
or any of these other
social media's platforms,

142
00:06:30.770 --> 00:06:34.330
will have authorization to share

143
00:06:34.330 --> 00:06:40.120
your information as part
of their company terms.

144
00:06:40.120 --> 00:06:41.980
When you sign those
terms of consent,

145
00:06:41.980 --> 00:06:43.360
a lot of times you're

146
00:06:43.360 --> 00:06:47.425
consenting to giving
your privacy away.

147
00:06:47.425 --> 00:06:50.045
We talked about the
Fourth Amendment,

148
00:06:50.045 --> 00:06:52.195
a few slides back.

149
00:06:52.195 --> 00:06:54.820
If we violate the
Fourth Amendment,

150
00:06:54.820 --> 00:06:58.875
if we see something
illegally or in violation,

151
00:06:58.875 --> 00:07:01.270
that in evidence will not

152
00:07:01.270 --> 00:07:03.605
be admissible in a court of law.

153
00:07:03.605 --> 00:07:07.735
If we search some place
without a warrant and we don't

154
00:07:07.735 --> 00:07:09.955
have probable cause or

155
00:07:09.955 --> 00:07:12.730
meet any of those exceptions
mentioned earlier,

156
00:07:12.730 --> 00:07:14.820
then that would be
seizing something

157
00:07:14.820 --> 00:07:17.560
illegally and it will
not be admissible.

158
00:07:17.560 --> 00:07:20.400
Also, if we seize evidence

159
00:07:20.400 --> 00:07:24.710
illegally and that leads
us to other evidence,

160
00:07:24.710 --> 00:07:27.575
even if we seize that
new evidence legally,

161
00:07:27.575 --> 00:07:30.630
because we found it based

162
00:07:30.630 --> 00:07:33.635
on what we learned from the
evidence we seized illegally,

163
00:07:33.635 --> 00:07:35.790
that new evidence will also be

164
00:07:35.790 --> 00:07:38.480
not admissible in a court of law,

165
00:07:38.480 --> 00:07:42.740
and that is called the fruits
of the poisonous tree.

166
00:07:42.740 --> 00:07:48.150
If you act with malice or
irresponsibility or any type of

167
00:07:48.150 --> 00:07:50.915
recklessness and you violate

168
00:07:50.915 --> 00:07:54.110
any of these guidelines or laws,

169
00:07:54.110 --> 00:07:56.860
you will be found in

170
00:07:56.860 --> 00:07:58.260
violation and you could have

171
00:07:58.260 --> 00:08:00.665
a civil case brought against you.

172
00:08:00.665 --> 00:08:02.735
You could be sued civilly.

173
00:08:02.735 --> 00:08:05.779
If you don't have
search authority

174
00:08:05.779 --> 00:08:09.025
and you do that
examination anyway,

175
00:08:09.025 --> 00:08:11.330
you could end up
getting yourself sued.

176
00:08:11.330 --> 00:08:13.335
You really want to be careful

177
00:08:13.335 --> 00:08:15.790
when you're looking at
your search authority,

178
00:08:15.790 --> 00:08:17.800
when you're looking
at these warrants or

179
00:08:17.800 --> 00:08:20.080
other legal process
that they do give you

180
00:08:20.080 --> 00:08:22.055
the authority to do

181
00:08:22.055 --> 00:08:25.330
the examination that
you are going to do.

182
00:08:25.330 --> 00:08:29.425
Civil versus criminal: We
talked about this a little bit.

183
00:08:29.425 --> 00:08:31.890
Civil cases are usually about

184
00:08:31.890 --> 00:08:36.170
property crimes,
monetary damages.

185
00:08:36.170 --> 00:08:38.440
They're going to
determine who's going to

186
00:08:38.440 --> 00:08:40.340
be liable for this loss.

187
00:08:40.340 --> 00:08:44.755
The standard of proof is a
preponderance of the evidence,

188
00:08:44.755 --> 00:08:47.050
versus a criminal case,

189
00:08:47.050 --> 00:08:50.500
which is something that is
punishable full by law.

190
00:08:50.500 --> 00:08:53.360
This is a crime, you can
go to jail for this.

191
00:08:53.360 --> 00:08:56.500
The standard of proof
here is higher,

192
00:08:56.500 --> 00:09:00.175
and that is going to be proof
beyond a reasonable doubt.

193
00:09:00.175 --> 00:09:02.300
The best evidence rule:

194
00:09:02.300 --> 00:09:04.260
The original evidence is always

195
00:09:04.260 --> 00:09:06.680
going to be your best evidence.

196
00:09:06.680 --> 00:09:09.460
When the original evidence is not

197
00:09:09.460 --> 00:09:14.540
available, duplicates
are admissible.

198
00:09:15.840 --> 00:09:20.540
Duplicates, including
electronic recordings,

199
00:09:20.540 --> 00:09:24.940
but they have to accurately
depict the original evidence.

200
00:09:24.940 --> 00:09:27.785
They can't be bias or

201
00:09:27.785 --> 00:09:30.380
an inaccurate representation or

202
00:09:30.380 --> 00:09:33.105
an unfair representation
of the original evidence,

203
00:09:33.105 --> 00:09:36.560
then they would
not be admissible.

204
00:09:36.560 --> 00:09:38.990
But duplicates are admissible

205
00:09:38.990 --> 00:09:41.075
when the original
is not available,

206
00:09:41.075 --> 00:09:42.190
but the original is

207
00:09:42.190 --> 00:09:44.675
always going to be
your best evidence.

208
00:09:44.675 --> 00:09:46.950
We do have some
special situations.

209
00:09:46.950 --> 00:09:49.635
I mentioned wiretaps briefly,

210
00:09:49.635 --> 00:09:53.860
real-time intersection
of transmissions.

211
00:09:53.860 --> 00:09:57.115
We also have stored
electronic communications.

212
00:09:57.115 --> 00:09:59.380
These are communications
that are going to

213
00:09:59.380 --> 00:10:02.095
be stored by maybe your
Internet service provider,

214
00:10:02.095 --> 00:10:04.690
your phone service provider,

215
00:10:04.690 --> 00:10:06.370
if you're using a
cellular telephone

216
00:10:06.370 --> 00:10:08.035
or any other type of telephone.

217
00:10:08.035 --> 00:10:09.940
We're going to also talk about

218
00:10:09.940 --> 00:10:12.455
the Privacy Protection Act.

219
00:10:12.455 --> 00:10:16.980
Now, the laws and rules

220
00:10:16.980 --> 00:10:19.770
governing physical evidence and

221
00:10:19.770 --> 00:10:22.665
electronic evidence are
generally the same.

222
00:10:22.665 --> 00:10:25.625
But there are some things
we do need to keep in mind.

223
00:10:25.625 --> 00:10:27.940
The computers can be used for

224
00:10:27.940 --> 00:10:31.490
both legal and
illegal activities.

225
00:10:31.520 --> 00:10:35.760
They can also be used
to protect information.

226
00:10:35.760 --> 00:10:37.350
There are special laws

227
00:10:37.350 --> 00:10:39.870
that protect electronic
communications.

228
00:10:39.870 --> 00:10:44.030
We're going to talk about
those throughout this course.

229
00:10:44.030 --> 00:10:48.130
The Stored Electronic
Communications Act.

230
00:10:48.130 --> 00:10:51.730
Now, this act,

231
00:10:51.730 --> 00:10:55.960
generally applies to your
Internet service provider.

232
00:10:55.960 --> 00:10:58.660
They collect information as

233
00:10:58.660 --> 00:11:00.625
course of their regular business,

234
00:11:00.625 --> 00:11:02.545
as part of doing business.

235
00:11:02.545 --> 00:11:05.650
This act says that they cannot

236
00:11:05.650 --> 00:11:11.845
just disclose this
information to anybody.

237
00:11:11.845 --> 00:11:15.830
That you do have some
right to privacy here.

238
00:11:16.410 --> 00:11:20.890
Law enforcement agencies
can't just ask them.

239
00:11:20.890 --> 00:11:23.470
They have to have
probable cause to get

240
00:11:23.470 --> 00:11:26.680
your information from your
Internet service providers,

241
00:11:26.680 --> 00:11:29.680
or any of your social media.

242
00:11:29.680 --> 00:11:32.635
The provider protection.

243
00:11:32.635 --> 00:11:36.040
This authorizes the
intersection and

244
00:11:36.040 --> 00:11:38.170
disclosure of
information collected

245
00:11:38.170 --> 00:11:39.640
as part of their
regular business.

246
00:11:39.640 --> 00:11:42.985
You can't ask an Internet
service provider,

247
00:11:42.985 --> 00:11:50.450
or any type of Internet
social media account,

248
00:11:50.700 --> 00:11:54.985
to collect something
on a specific person,

249
00:11:54.985 --> 00:11:57.625
to help you with
one of your cases.

250
00:11:57.625 --> 00:11:59.140
But if this information is

251
00:11:59.140 --> 00:12:01.614
collected as part of
their regular business,

252
00:12:01.614 --> 00:12:03.655
they can turn it over to you,

253
00:12:03.655 --> 00:12:07.705
as long as you have the
authorization to get it.

254
00:12:07.705 --> 00:12:09.250
You're going to need some type of

255
00:12:09.250 --> 00:12:12.110
warrant or subpoena for that.

256
00:12:12.390 --> 00:12:16.930
This talks about, that the
Internet service provider,

257
00:12:16.930 --> 00:12:19.765
can't turn over to
law enforcement

258
00:12:19.765 --> 00:12:23.020
some information that was
obtained inadvertently.

259
00:12:23.020 --> 00:12:24.940
Maybe it was something that

260
00:12:24.940 --> 00:12:26.950
they don't collect
as regular business,

261
00:12:26.950 --> 00:12:30.175
but they just happen to have it.

262
00:12:30.175 --> 00:12:32.740
They can turn it over to

263
00:12:32.740 --> 00:12:37.075
law enforcement with the
proper legal service.

264
00:12:37.075 --> 00:12:39.940
If it pertains or appears to

265
00:12:39.940 --> 00:12:42.655
pertain to a
commission of a crime.

266
00:12:42.655 --> 00:12:45.880
Again, going back to
the example I used,

267
00:12:45.880 --> 00:12:49.300
as far as somebody
puts pictures at

268
00:12:49.300 --> 00:12:53.080
their Dropbox that shows
obvious child pornography,

269
00:12:53.080 --> 00:12:54.850
the Internet service provider

270
00:12:54.850 --> 00:12:58.525
would contact law enforcement
and let them know about it.

271
00:12:58.525 --> 00:13:02.395
Or if they inadvertently
take the conversation,

272
00:13:02.395 --> 00:13:05.800
voicemail message that they held,

273
00:13:05.800 --> 00:13:08.665
that maybe they
usually don't hold,

274
00:13:08.665 --> 00:13:11.965
as part of their business,
but it happened,

275
00:13:11.965 --> 00:13:14.320
and they realized
that it does pertain

276
00:13:14.320 --> 00:13:16.330
to some type of
criminal activity,

277
00:13:16.330 --> 00:13:18.910
they can notify law enforcement,

278
00:13:18.910 --> 00:13:22.045
and turn that particular evidence

279
00:13:22.045 --> 00:13:24.530
over to law enforcement.

280
00:13:26.130 --> 00:13:29.680
This talks about also
that they are required to

281
00:13:29.680 --> 00:13:33.460
report child exploitation to

282
00:13:33.460 --> 00:13:36.835
the National Center for Missing
and Exploited Children.

283
00:13:36.835 --> 00:13:40.330
They usually do, and then that in

284
00:13:40.330 --> 00:13:43.705
course will get turned
over to law enforcement.

285
00:13:43.705 --> 00:13:47.065
This Privacy Protection
Act, the PPA,

286
00:13:47.065 --> 00:13:48.625
this is what protects

287
00:13:48.625 --> 00:13:52.525
journalists from
government officials,

288
00:13:52.525 --> 00:13:54.265
who wanted to search.

289
00:13:54.265 --> 00:13:57.325
This is your protected
work product.

290
00:13:57.325 --> 00:14:01.285
If you write a book and that
book is on your computer,

291
00:14:01.285 --> 00:14:03.565
and your computer gets seized

292
00:14:03.565 --> 00:14:08.395
now you can't just take that.

293
00:14:08.395 --> 00:14:10.705
That's that person's
personal property.

294
00:14:10.705 --> 00:14:12.820
You may have to adjust

295
00:14:12.820 --> 00:14:15.070
your search parameters
if they have

296
00:14:15.070 --> 00:14:17.545
some type of protected
material on there,

297
00:14:17.545 --> 00:14:19.975
and that does apply
to journalists,

298
00:14:19.975 --> 00:14:23.330
and other type of
copyrighted material.

299
00:14:24.060 --> 00:14:26.605
You must get some type of

300
00:14:26.605 --> 00:14:31.220
legal process to obtain
any type of work product.

301
00:14:33.260 --> 00:14:35.415
If you don't have that,

302
00:14:35.415 --> 00:14:39.150
you will have to adjust
your search, accordingly.

303
00:14:39.150 --> 00:14:41.295
The Daubert rule.

304
00:14:41.295 --> 00:14:44.760
This obtains to the admissibility
of scientific evidence,

305
00:14:44.760 --> 00:14:46.965
and this is going to
pertain to us in our field.

306
00:14:46.965 --> 00:14:50.955
This also pertains to
qualified expert witnesses.

307
00:14:50.955 --> 00:14:53.685
Talking about
scientific evidence,

308
00:14:53.685 --> 00:14:55.500
you're meant to use a type of

309
00:14:55.500 --> 00:14:57.660
technique that has
been used before,

310
00:14:57.660 --> 00:14:59.415
that's been tested and verified

311
00:14:59.415 --> 00:15:01.785
either by you or
by somebody else.

312
00:15:01.785 --> 00:15:06.075
But whatever you're doing has
to be tested and verified.

313
00:15:06.075 --> 00:15:09.900
Your reports and your findings

314
00:15:09.900 --> 00:15:11.655
should be subject to peer review.

315
00:15:11.655 --> 00:15:14.355
You should have peer review
in place where another person

316
00:15:14.355 --> 00:15:17.985
will review your work to
make sure that it's correct.

317
00:15:17.985 --> 00:15:21.495
There should be some type
an known rate of error.

318
00:15:21.495 --> 00:15:23.580
If you're talking about DNA or

319
00:15:23.580 --> 00:15:26.190
fingerprints or say hash values,

320
00:15:26.190 --> 00:15:28.990
there is a known rate of error.

321
00:15:30.230 --> 00:15:33.210
The method has to be one that is

322
00:15:33.210 --> 00:15:37.095
acceptable in your
scientific community.

323
00:15:37.095 --> 00:15:41.610
You can't use a method that
nobody has used before,

324
00:15:41.610 --> 00:15:43.350
that you haven't
tested and verified,

325
00:15:43.350 --> 00:15:45.480
that would not be appropriate.

326
00:15:45.480 --> 00:15:48.720
Again, investigators
must be qualified

327
00:15:48.720 --> 00:15:52.245
before they could testify
as an expert witness,

328
00:15:52.245 --> 00:15:53.835
and that would be done in court

329
00:15:53.835 --> 00:15:56.010
with the attorneys present.

330
00:15:56.010 --> 00:15:58.350
Ethics. As we talked about,

331
00:15:58.350 --> 00:16:01.600
they're a set of principles
that guide our behavior,

332
00:16:01.730 --> 00:16:04.560
and it's very important that

333
00:16:04.560 --> 00:16:07.890
we have a good code of ethics.

334
00:16:07.890 --> 00:16:10.440
A lot of your organizations,

335
00:16:10.440 --> 00:16:12.300
a lot of your certifying boards

336
00:16:12.300 --> 00:16:13.950
have their own code of ethics,

337
00:16:13.950 --> 00:16:16.035
and if you hold
the certification,

338
00:16:16.035 --> 00:16:19.140
you might want to familiarize
yourself with the code of

339
00:16:19.140 --> 00:16:22.455
ethics and standards for that
particular certification.

340
00:16:22.455 --> 00:16:23.925
Because if you violate it,

341
00:16:23.925 --> 00:16:25.920
you could lose your
certification,

342
00:16:25.920 --> 00:16:29.070
and if that's part of your job,

343
00:16:29.070 --> 00:16:32.250
you must have the certification
to hold your job,

344
00:16:32.250 --> 00:16:34.710
you want to be very careful about

345
00:16:34.710 --> 00:16:38.100
losing it due to an
ethics violation.

346
00:16:38.100 --> 00:16:40.740
Again, it could lead
to civil action.

347
00:16:40.740 --> 00:16:44.445
You could be sued for your
unethical actions, and again,

348
00:16:44.445 --> 00:16:47.130
it just makes you look bad and it

349
00:16:47.130 --> 00:16:50.800
makes the entire
profession look bad.

350
00:16:50.810 --> 00:16:54.270
I talked about this.
Organizations have their own set

351
00:16:54.270 --> 00:16:56.880
of guidelines and
they will differ,

352
00:16:56.880 --> 00:17:00.720
so you want to be familiar
with your code of

353
00:17:00.720 --> 00:17:02.910
ethics for your organization

354
00:17:02.910 --> 00:17:06.000
and for any type of
certification you hold.

355
00:17:06.000 --> 00:17:10.005
We have to make
decisions in situations

356
00:17:10.005 --> 00:17:14.850
that are not so clear-cut,

357
00:17:14.850 --> 00:17:16.770
and we're going to talk
about that more as we talk

358
00:17:16.770 --> 00:17:18.980
about what we do,

359
00:17:18.980 --> 00:17:22.085
imaging and collecting
of evidence.

360
00:17:22.085 --> 00:17:24.290
The most important
thing to remember

361
00:17:24.290 --> 00:17:26.525
here is you want to be able to

362
00:17:26.525 --> 00:17:31.945
articulate what you did
and why it was necessary.

363
00:17:31.945 --> 00:17:35.940
Also, poor decision-making
even outside of

364
00:17:35.940 --> 00:17:37.980
your professional life can

365
00:17:37.980 --> 00:17:42.250
reflect badly on you
and your employer.

366
00:17:42.560 --> 00:17:45.945
Due care is very important.

367
00:17:45.945 --> 00:17:47.625
When you make a decision,

368
00:17:47.625 --> 00:17:50.820
make sure that you think about

369
00:17:50.820 --> 00:17:52.770
all the consequences
of that decision and

370
00:17:52.770 --> 00:17:55.755
use due care before you proceed.

371
00:17:55.755 --> 00:17:57.450
Make sure you're working within

372
00:17:57.450 --> 00:17:59.565
the scope of your
search authority,

373
00:17:59.565 --> 00:18:02.310
make sure you're not changing
the original evidence,

374
00:18:02.310 --> 00:18:03.750
and if you are making changes,

375
00:18:03.750 --> 00:18:05.100
make sure you
document what you're

376
00:18:05.100 --> 00:18:07.365
doing and why you're doing it.

377
00:18:07.365 --> 00:18:09.390
Other laws that apply to

378
00:18:09.390 --> 00:18:11.400
us are going to be
the Patriot Act,

379
00:18:11.400 --> 00:18:12.750
and this is going to talk more

380
00:18:12.750 --> 00:18:14.100
about real-time interception or

381
00:18:14.100 --> 00:18:18.435
wiretapping that mainly
pertains to terrorist acts.

382
00:18:18.435 --> 00:18:25.365
You do have a little more
leeway with this type of crime.

383
00:18:25.365 --> 00:18:28.050
Terrorism, we can use

384
00:18:28.050 --> 00:18:30.000
the Patriot Act and you can

385
00:18:30.000 --> 00:18:32.460
get around some of the
warrant requirements,

386
00:18:32.460 --> 00:18:35.070
which you want to make
sure that you are working

387
00:18:35.070 --> 00:18:36.480
within the four
corners of the law

388
00:18:36.480 --> 00:18:37.710
and that you know
what you're doing,

389
00:18:37.710 --> 00:18:40.290
and you probably want to
talk to a prosecutor.

390
00:18:40.290 --> 00:18:43.815
The Protect our
Children Act of 2008.

391
00:18:43.815 --> 00:18:47.610
This pertains to reporting

392
00:18:47.610 --> 00:18:50.220
requirements for online
crimes against children,

393
00:18:50.220 --> 00:18:52.380
and I talked about
that when we talked

394
00:18:52.380 --> 00:18:54.810
about the National Center

395
00:18:54.810 --> 00:18:56.685
for Missing and
Exploited Children,

396
00:18:56.685 --> 00:18:59.880
and how Internet service
providers are required to

397
00:18:59.880 --> 00:19:03.705
report any type of child
exploitation to them.

398
00:19:03.705 --> 00:19:07.875
Medical records, HIPAA is
going to come into play.

399
00:19:07.875 --> 00:19:10.110
If you're talking about doing

400
00:19:10.110 --> 00:19:12.015
any work for a
healthcare professional,

401
00:19:12.015 --> 00:19:14.070
you want to keep
that in mind that

402
00:19:14.070 --> 00:19:16.740
health records are private and

403
00:19:16.740 --> 00:19:18.685
you want to familiarize

404
00:19:18.685 --> 00:19:22.455
yourself with the HIPAA
law requirements.

405
00:19:22.455 --> 00:19:24.840
In the next module,

406
00:19:24.840 --> 00:19:30.030
we're going to talk about
preservation and consent.

407
00:19:30.030 --> 00:19:32.145
We're going to talk about
preserving the evidence,

408
00:19:32.145 --> 00:19:33.420
and we're going to talk about

409
00:19:33.420 --> 00:19:37.840
consent searches and the
rules that govern them.