Operation Stop Hack

Relevant Legal and Constitutional Statutes

The main legal statute relevant to hacking and the one I would resort to in prosecuting
a hacking case is the Computer Fraud and Abuse Act (CFAA). CFAA is directly applicable to
hacking crimes as it prohibits and criminalizes any unauthorized access to a computer or
computer network with the intent to defraud or commit any other cybercrime (Nelson,
Phillips, & Steuart, 2019). Besides CFAA, two provisions of the U.S. federal Constitution
would be especially relevant to the conduct of my investigations: the Fourth and Fifth
Amendments. By creating freedom from “unreasonable” searches and confiscations, the
Fourth Amendment imposes constraints on my ability to search suspects’ premises and seize
evidence. Meanwhile, the Fifth Amendment states that law enforcers and investigators cannot
compel a suspect to witness against himself, thereby creating the privilege against self-
incrimination. The implication of all this is that, in collecting evidence against suspects, I will
have to be careful not to violate the Fourth and Fifth Amendments, lest a court of law void
my evidence.

Approaching the Crime Scene and Processing the Digital Evidence
The FBI advises on the steps an investigator should follow in collecting and
preserving digital evidence for the evidence to be admissible in court (Easttom & Taylor,
2011). First, I would need to secure the crime scene and preserve computing equipment in the
state I found them in on arriving at the scene. Next, I would make accurate backup copies of
any logs and files the suspect might have left behind. These would likely provide traces of the
suspect’s activities. Lastly, I would trace some victims of the suspect’s activities and
document their losses. The losses are likely to include the monetary value of the manpower
spent on responding to the attack and recovering data, the value of any lost or stolen data

OPERATION STOP HACK 3
(including the costs incurred to obtain the data and how much it will cost to recover it), and
any income lost as a result of business downtime. Having secured the evidence, I would use
EnCase Forensic, one of the most widely used computer forensics tools, to process it. Encase
Forensic’s main functions include acquiring evidence, processing it, performing deep forensic
analysis, compiling findings, and archiving cases (Easttom & Taylor, 2011). The tool can
acquire evidence from a variety of hardware, including hard drives, removable media, tablets,
and smartphones.

Analyzing the Crime Scene Diagram

While many hardware devices may be present at the crime scene, the following
devices would be particularly useful in gathering forensic evidence: the PC, the smartphone,
and the wireless access point (WAP). The PC would be important because it is highly likely
to run on a Microsoft Windows OS. Because of its popularity, the Windows OS is an often
readily available source of digital evidence (Casey, 2011). Also, many companies have
developed powerful forensic tools that facilitate the forensic investigation of Windows
systems. The smartphone is likely to yield information on the people the suspect has been
communicating with a lot lately, thereby pointing to possible crime collaborators and victims.
The WAP may have locally stored records of connection attempts. Several failed connection
attempts may point to attempts to hack into a network. Also, an unauthorized party may have
modified the WAP configuration as part of an attack.

OPERATION STOP HACK 4

References

Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and
the Internet (3 rd ed.). Waltham: Elsevier Inc.
Easttom, C., & Taylor, J. (2011). Computer Crime, Investigation, and the Law. Boston:
Cengage Learning.
Nelson, B., Phillips, A., & Steuart, C. (2019). Guide to Computer Forensics and
Investigations (6 th ed.). Boston: Cengage Learning.