Whitepaper What Would You Do? by R. Lance Fogarty, CISSP, CCE What is ethics?

? Is there any value in ethical behavior within the Computer Forensics industry? Read this whitepaper and judge for yourself. The information on ethics that follows is primarily derived from more substantial work completed at the Josephson Institute of Ethics. Ethics Defined Ethics are standards for thought, word, and deed that constrain a person to do what is right and good (rather than simply what is easy, comfortable, or self-serving). We use the word "ethics" to refer primarily to an individual's inner standards based on orientation, intention, and motivation. In order to apply this definition to practical decision making it is necessary to specify the nature of the moral obligations considered intrinsic to ethical behavior. There are two aspects to ethics: the first involves the ability to discern right from wrong, good from evil, and propriety from impropriety; the second involves the commitment to do what is right, good and proper. Ethics is an action concept; it is not simply an idea to think and argue about. The terms "values" and "ethics" are not interchangeable. Ethics is concerned with how a moral person should behave, whereas values simply concern the various beliefs and attitudes that determine how a person actually behaves. Some values concern ethics when they pertain to beliefs as to what is right and wrong; most values do not. A person who believes that certain races are inferior to others and therefore that it is "right" to oppress or persecute those races has adopted a personal value system that is inherently "unethical" according to the universal and consensus values associated with normative ethics. Similarly, an individual who has decided that lying is proper if it is necessary to achieve an important personal goal cannot assert personal ethics as a shield against impropriety. People need to understand that ethical principles are ground rules of decision making - not just factors to consider. Clearly, not all choices and value systems, however dearly held, are equally "ethical." A Practical Example The Scenario: Child Custody - An attorney, representing the husband, calls on Thursday morning. He has a hearing on Friday to determine if he will be allowed access to the wifes computer systems. He needs justification for enforcing his subpoena. His client, the husband, claims his wife sent him a virus, via email, intentionally on Sunday of this same week. The attorney and husband needed to know the likelihood, by Friday morning, that the virus was from her and the potential of intentional behavior. The Problem: Time was short. Normal forensic procedures can not be vacated. Was there time? Could any level of likelihood be found? What about the question of intention? The Solution: Normal forensic procedures were followed to the letter. This is a strict requirement in any proceedings. This would mean some late night processing in order to meet the deadline. When the analysis phase began, it became quickly apparent something was not quite right. Further analysis was performed to ensure 100% accurate information. Our findings confirmed that, while very cleverly executed, the entire virus and email scenario was manufactured by the husband. Our study of the evidence also had shown the husbands computer system has been reformatted and reinstalled the Saturday before the virus arrived. His computer system dates were changed numerous times over that particular weekend, presumably to make it look like an old install.

Page 1 of 2

Follow-up: Ethical behavior prevents us from lying or perpetrating a fraud regardless of the cost to us. Instead of an affidavit supporting his cause, we had to phone the attorney and inform him of his clients actions. We also requested the attorney to inform his client of the consequences of his actions. On The Other Hand Computer forensics is as much an art as it is a science. Unlike the example detailed above, not all examinations produce a singular interpretation. Whether we are performing the original investigation or evaluating someone elses work, it is our job to find all the possible answers. This means finding the plausible, reproducible facts and theories. This also means ensuring accurate and forensically sound procedures were followed. Improper procedures will very often distort or cover up reliable facts. At times, this creates a very fine line. A line that is unethical to cross over. Impossible, implausible, and non-reproducible theories would only serve to confuse the facts and amounts to pulling the technical wool over the eyes of the court. On the Plaintiffs side, it is our job to lay out that which most likely occurred. On the Defendants side, it is our job to find plausible alternatives to the accusations. In either instance, proper forensic procedures are paramount. Conclusion As witnessed in the example above, we do not permit impropriety at any time and will always act ethically, responsibly, and in accordance with laws; even if its not in our best interest. Needless to say, we did not get any additional work from that client; however, the client attested to our findings and the attorney continues to call on our services. In the example, what would you have done? Do ethics really matter? Of course it does. Most computer systems involved in legal matters contain some form of confidential data, proprietary data, sensitive information, privileged communications, or possibly contraband. It is vitally important to your cause that both sides of the case trust your Computer Forensic firm to protect these items. Direct access to computerized data is not necessarily automatic in every case. In addition to trust, any testimony based upon a Computer Forensic investigation must be believable and all actions beyond reproach. Ethics Doing what is right, even when its not in your own best interest. For information about PROTEGGA LLC or this whitepaper, feel free to contact us: http://www.protegga.com AskThePman@protegga.com 214.227.9752

Page 2 of 2