Cyber Crime and Cyber Terrorism Investigator’s Handbook Cyber Crime and Cyber Terrorism Investigator’s Handbook Edited by Babak Akhgar Andrew Staniforth Francesca Bosco AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an Imprint of Elsevier Acquiring Editor: Steve Elliot Editorial Project Manager: Benjamin Rearick Project Manager: Priya Kumaraguruparan Designer: Mark Rogers Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA Copyright © 2014 Elsevier Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described here in. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Akhgar, Babak. Cyber crime and cyber terrorism investigator's handbook / Babak Akhgar, Francesca Bosco, Andrew Staniforth. pages cm Includes bibliographical references and index. 1. Computer crimes–Investigation. 2. Cyberterrorism–Investigation. 3. Computer crimes– Investigation–Case studies. 4 Cyberterrorism–Investigation–Case studies. I. Bosco, Francesca II. Staniforth, Andrew. III. Title. HV8079.C65A37 2014 363.25'968–dc23 2014017880 British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library ISBN: 978-0-12-800743-3 For information on all Syngress publications, visit our website at http://store.elsevier.com/syngress This book has been manufactured using Print On Demand technology. Each copy is produced to order and is limited to black ink. The online version of this book will show color figures where appropriate Acknowledgments The editors wish to thank the multidisciplinary team of experts who have contributed to this book, sharing their knowledge and experience. Thanks are also extended to Lord Carlile of Berriew CBE QC for supporting this work. We would also like to take this opportunity to acknowledge the contribution of the team at CENTRIC (Centre of excellence in terrorism, resilience, intelligence, and organized crime research, at Sheffield Hallam University) and for the support provided by West Yorkshire Police, the Office of the Police and Crime Commissioner for West Yorkshire, and the United Nations Interregional Crime and Justice Research Institute (UNICRI). And finally, we express our gratitude and appreciation to Dr. Eleanor Lockley. Her contribution and dedication has made this edited volume possible. We would particularly like to acknowledge the following organizations and indi- viduals for their support: Sheffield Hallam University West Yorkshire Police Office of the Police and Crime Commissioner for West Yorkshire United Nations Interregional Crime and Justice Research Institute v Endorsements “This authoritative volume provides all security practitioners with a trusted reference and resource to guide them through the complexities of investigating cyber crime and cyber terrorism.” Lord Carlile of Berriew CBE QC “The global multi-disciplinary team of expert contributors have compiled an excellent operational reference and resource to support the new generation of cyber investigators.” John D Parkinson OBE Chair of Centre of Excellence in Terrorism, Resilience, Intelligence & Organised Crime Research (CENTRIC) vii Contributors Babak Akhgar Director of CENTRIC, Sheffield Hallam University, UK Ameer Al-Nemrat University of East London, UK P. Saskia Bayerl Rotterdam School of Management, Erasmus University, The Netherlands Francesca Bosco University of Milan, Italy Giovanni Bottazzi Dipartimento di Ingegneria Civile e Ingegneria Informatica, Unversita di Roma 'Tor Vergata', Roma Ben Brewster CENTRIC, Sheffield Hallam University, UK Emelyn Butterfield Lecturer, Leeds Metropolitan University, UK Daniel Cohen Research Fellow, The Institute of National Security Studies, Tel Aviv University, Israel Alan Cook Agenci Information Security (AIS) Consultancy, UK Mohammed Dastbaz Dean of the Faculty of the Arts, Environment and Technology, Leeds Metropolitan University, UK Ruairidh Davison Human Systems Integration Group, Coventry University, UK David Day Senior Lecturer, Sheffield Hallam University, UK Konstantinos Domdouzis CENTRIC, Sheffield Hallam University, UK Helen Gibson CENTRIC, Sheffield Hallam University, UK Edward Halpin Leeds Metropolitan University, UK Bruno Halupeau European Crime Centre EC3, Eurpol xvii xviii Contributors Gary Hibberd Agenci Information Security (AIS) Consultancy, UK Amin Hosseinian-Far Williams College, UK John Huddlestone Coventry University, UK Hamid Jahankhani Director of Research and Consultancy Development, Williams College, UK Eleanor Lockley Researcher, CENTRIC, Sheffield Hallam University, UK Eric Luiijf TNO Networked Organisations Principal Consultant C(I)IP& Cyber Ops Networked Organisations, The Hague, The Netherlands Alessandro Mantelero Polytechnic University of Turin, Italy Gianluigi Me CeRSI, Research Center in Information Systems, LUISS Guido Carli University, Roma Dale Richards Senior Lecturer, Human Technology Centre, Coventry University, UK Fraser Sampson Chief Executive and Solicitor of the Office of Police and Crime Commissioner, West Yorkshire Police, UK Siraj A. Shaikh Digital Security and Forensics (SaFe) Research Group, Coventry University, UK Andrew Staniforth West Yorkshire Police, UK Alex W. Stedmon Reader in Human Factors, Human Systems Integration Group, Coventry University, UK Giuseppe Vaciago Polytechnic University of Turin, Italy Sufian Yousef Anglia Ruskin University, UK Author Biography BABAK AKHGAR Babak Akhgar is Professor of Informatics and Director of CENTRIC (Center of excel- lence in terrorism, resilience, intelligence and organized crime research) at Sheffield Hallam University and Fellow of the British Computer Society. Akhgar graduated from Sheffield Hallam University in Software Engineering. He gained considerable commercial experience as a Strategy Analyst and Methodology Director for several international companies. Prof. Babak Akhgar obtained a Master degree (with distinc- tion) in Information Systems in Management and a PhD in Information Systems. He has more than 100 referred publications in international journals and confer- ences on information systems with specific focus on knowledge management (KM). He is member of editorial boards of a number of international Journals, Chair and programme committee member of several international conferences. Akhgar has ex- tensive and hands on experience in development, management and execution of KM projects and large international security initiatives (e.g., Application of social me- dia in crisis management, intelligence-based combating of terrorism and organised crime, Gun crime, cyber security, Public Order and cross cultural ideology polariza- tion) with multimillion Euros budgets. In addition to this he is the technical lead of two EU Security projects; “Courage” which focuses on Cyber Crime and Cyber Terrorism and “Athena project” which focuses on the application of social media and mobile devices in crisis management. He has co-edited a book on Intelligence management (Knowledge Driven frame- works for combating Terrorism and Organised crime). His recent books are titled Strategic Intelligence Management (National Security Imperatives and Information and Communications Technologies) 2013 and Emerging Trends in ICT Security 2014. Prof. Akhgar is also a member of academic advisory board of SAS UK. ANDREW STANIFORTH Detective Inspector Andrew Staniforth has extensive operational counter-terrorism ex- perience in the UK. As a qualified teacher he has designed national counter-terrorism exercise programmes and delivers training to police commanders from across the world at the UK College of Policing. He is the author of the Blackstone’s Counter-Terrorism Handbook (Oxford University Press, 2013), the Blackstone’s Handbook of Ports and Borders Security (Oxford University Press, 2013), the Routledge Companion to UK Counter-Terrorism (Routledge, 2012) and Preventing Terrorism and Violent Extremism (Oxford University Press, 2014). Andrew is a Senior Research Fellow at the Centre of Excellence