Strengthening forensic investigations of child pornography on P2P networks

Measurements of the Internet for law enforcement purposes must be forensically valid. We examine the problems inherent in using various network- and applicationlevel identifiers in the context of forensic measurement, as exemplified in the policing of peer-to-peer file sharing networks for sexually exploitative imagery of children (child pornography, or CP). First, we present a characterization of measurements of these networks, including large-scale measurements performed in the law enforcement context. We then show how the identifiers in these measurements can be unreliable, and propose the tagging of remote machines. Our proposed tagging method marks remote machines by providing them with application- or system-level data that is valid, but covertly has meaning to investigators. This tagging allows investigators to link network observations with physical evidence in a legal, forensically strong, and valid manner. We present a detailed model and analysis of our method, show how tagg...

• Type: Journal
• Year: 2010
• Where: CONEXT
• Authors: Marc Liberatore, Brian Neil Levine, Clay Shields
• Keywords: Computer Networks, CONEXT 2010, Law Enforcement, Law Enforcement Purposes, Measurements