STEVENSON UNIVERSITY FORENSICS JOURNAL A SCHOLARLY REVIEW VOLUME 6, 2015 STEVENSON UNIVERSITY FORENSICS JOURNAL VOLUME 6 EDITORIAL BOARD EDITOR-IN-CHIEF Carolyn Hess Johnson, Esq. PUBLISHER Carolyn Hess Johnson, Esq. EDITORS Abigail Howell Stephanie Leaf Susan Shlala FORENSICS JOURNAL After publishing the Stevenson University Forensics Journal annually for five years, it was time to try out something new. The Journal is still full of interesting articles touching many disciplines within the vast field we call Forensic Studies, and the articles are still fully student researched and written. However, this year we doubled the word limit requirement for the submissions. As a result, authors were given room to explore their subject matters a bit deeper, offer more extensive analysis and offer the reader a more thorough perspective on the topics Also new this year is an “Ask the Experts” column. The column is a feature that will give the reader perspective on a topic related to Forensic Studies by asking an expert to address common questions in his or her field. The experts will rotate to address different areas of Forensic Studies each year. Readers are encouraged to submit questions via email to [email protected]. I look forward to your participation in this aspect of the Journal. Once again, I offer my congratulations to the students from the Stevenson University Masters in Forensics program whose articles were selected for publication this year. Publication in the Journal is a highly competitive process and involves a tremendous commitment on the part of the author and editors. As always, the results are proof of the talent and dedication of our students. Carolyn Hess Johnson, Esquire Editor and Publisher 1 FORENSICS JOURNAL TABLE OF CONTENTS INTRODUCTION RECENT TRENDS OF ENFORCEMENT AND CAROLYN JOHNSON COMPLIANCE WITH THE FOREIGN COR- 1 36 RUPT PRACTICES ACT WILLIAM OLSEN ASK THE FORENSIC EXPERT: MICHAEL ROBINSON 4 DISRUPTING TERRORIST FINANCING: INTERAGENCY COLLABORATION, DATA 42 ANALYSIS, AND PREDICTIVE TOOLS REGULATIONS FOR OFF-BALANCE-SHEET ANDREA LYNCH PYON FINANCING PRODUCE RISKY FINANCIAL 6 STATEMENTS CRYSTAL ABRAHAM ERADICATING ELDER FINANCIAL ABUSE 52 CHERYL A. PANATTONI PROACTIVE DATA ANALYSIS TO PREVENT AND DETECT FRAUD IN SMALL BUSINESSES DATA ANALYSIS AND RELIABILITY 11 ROBERT E. BATES IN PREDICTING FRAUD 57 JOSEPH T. HARRIS, CIA, CFE TERRORISM IN CYBERSPACE: IS THE U.S. READY FOR A VIRTUAL 9/11? MEDICAID AND MEDICARE FRAUD, 19 KERA N. VALENTI WASTE AND ABUSE 65 LINDSAY M. WHEATLEY SECURITY IN THE CLOUD 25 JONATHAN MAY AFFINITY FRAUD: IDENTIFICATION AND PROSECUTION 30 CHRISTINE KREKE 3 STEVENSON UNIVERSITY Ask the Forensic Expert: Michael Robinson MICHAEL ROBINSON or later than what is displayed to the user. As a result, a file can be hidden and made to look like it was installed a long time ago, e.g., Michael Robinson is a computer forensic when the operating system was originally installed. On the surface, examiner and cyber threat analyst for a large timestomping may look efficient, but most file systems store dozens international company. He has performed of artifacts associated with each file, and when timestamps computer and cell phone exploitation and are analyzed across all of this metadata, timestomping typically analysis for customers in both the U.S. stands out. Intelligence Community and the private sector. Michael has performed computer forensic WHEN I NEED TO DISCARD MY CURRENT SMART PHONE examinations for the FBI’s Investigative Analysis Unit, where he FOR A NEW ONE, WHAT SHOULD I DO TO ENSURE THAT assisted special agents with counter-intelligence and criminal cases. MY OLD DATA HAS BEEN DELETED? Michael is the former CIO of the U.S. Department of Defense’s Business Transformation Agency, where he oversaw all information When discarding a smartphone, one of the safest ways to ensure technology and information assurance operations for the agency, that old user data, such as text messages, call logs, or Internet including overseeing all incident response and forensic investigations. history, is deleted is to complete a three-part process. This includes: 1. enabling encryption on the phone, 2. disabling cloud backups, Michael is the Program Coordinator and an Adjunct Professor and then 3. performing a factory reset of the phone. Resetting the for Stevenson University’s Master of Science in Cyber Forensics. smartphone will delete the encryption key and render the old user At Stevenson, he was the recipient of the Rose Dawson Award data unrecoverable. For older feature, i.e. dumb phones, the phone in 2013. He teaches courses in mobile device forensics, intrusion should be physically destroyed to ensure the chips holding data are analysis, and cyber warfare. Michael holds a Bachelor of Science in non-usable. This may mean destroying more than just the screen and Chemical Engineering, a Master of Science in Information Assurance, keyboard, which are often repairable. a Master of Science in Forensic Studies (concentrating on computer forensics), and a graduate certificate in Applied Intelligence. HOW DIFFICULT IS IT TO DELETE MY INTERNET HISTORY ASSOCIATED WITH MY BROWSER? Michael has presented at numerous national and international conferences including DEF CON, the DoD Cyber Crime By default, Internet browsers such as Google Chrome, Microsoft Conference, InfoSec World, and the BCISS Conference on Internet Explorer, and Mozilla Firefox, cache user activity on the Intelligence Analysis. He has authored over a dozen journal articles computer. This is done to make visiting websites more efficient. and a book on disaster recovery planning for nonprofit organizations. The browser will not need to re-download content, when a web page is visited subsequently. User’s can delete their browsers’ caches and IS IT REALLY POSSIBLE FOR A COMPUTER FORENSIC cookies; however, until the files are overwritten with new data, the EXAMINER TO RECOVER DELETED FILES? Internet history can be recovered. Additionally, most computers will also store fragments of data with Internet history in other operating It depends. When a user deletes a file, the pointers to the file are system files, such as temp files and swap files, to improve system deleted and the file system is told that it can re-use the storage space, efficiency. Most computers are connected to Local Area Networks, when it is needed. The file, itself, will still reside on the disk until it which employ firewalls and other security devices. These network is overwritten. During a computer forensic examination, it is possible devices, which a user cannot access directly, will frequently record to recover the deleted file until the old content is overwritten. It is portions of Internet activity. This information is retained for a time also likely that a portion of the file may be overwritten, rather than period determined by the administrators. the entire file, which will result in a fragment of the original file being recovered. COMPUTER FORENSICS OFTEN INVOLVES ANALYZING HARD DRIVES FROM COMPUTERS. WHAT OTHER DATA WHAT IS TIMESTOMPING AND HOW EFFECTIVE IS IT? IS ANALYZED AND IS IT CONSIDERED FORENSICALLY When files are saved to digital media, such as a hard drive or USB SOUND? flash drive, the file system stores data, which describes the file. This metadata includes filenames, timestamps, and other information. Digital forensics, which is broader than computer forensics, frequently Timestomping is a form of obfuscation, where a person or piece involves removing hard drives from computers and analyzing the of malicious software changes the timestamps associated with a file. contents stored on them. This is frequently referred to as “dead box” Timestomping may give the appearance of a file being created earlier forensics. In addition to this type of analysis, forensic examiners will 4 FORENSICS JOURNAL capture and analyze the contents of RAM in a running computer to gather running processes, passwords, and other volatile data, network traffic captured by firewalls, routers, and intrusion detection systems, mobile phones, and system backups. Provided the procedure to capture and analyze this data is appropriately documented and meets certain industry standards, these techniques are forensically sound. WHAT IS THE DISTINCTION BETWEEN A “SMART” PHONE AND A “DUMB” PHONE? “Smart phone” is the term used for mobile phones which can do more than just make phone calls and send text messages. They have more memory, better screens, more robust processors, have the ability to surf the web, download/run apps, and establish VPN connections. They function like computers, which can make phone calls. Android and Apple phones fall into this class. Dumb phones can perform only basic functions, such as making calls and sending text messages. A few of them have some built-in apps such as alarm clocks and calculators. These phones are smaller, have low-end processors, typically cannot surf the Internet, and do not allow the user to download/run third-party apps. Example: the cheap $10 phone you can buy at the grocery store. The terms “smart phone” and “feature phone” are real terms and are actually used in the industry. However, the industry has moved away from using the term “dumb” phone and went to “feature” phone. WILL HAVING A PASSWORD ON MY MOBILE PHONE PROTECT IT FROM HAVING THE DATA ACCESSED? Many people use passwords to lock the keyboard and screen on dumb phones. Dumb phones allow a user to lock their phones to avoid the so-called “butt dialing” or to prevent a stranger from picking up the phone and scrolling through it. The passcode typically does not lock the data port on the phone. Therefore, in many, but not all situations, a mobile device forensic tool can be used to conduct an acquisition of the locked phone, which will recover the user data from the phone. On smart phones, the password may or may not protect the phone and its data from being accessed.