Many countries around the world are trying to, first of all, provide internet accessits citizens, others, a little more developed, are trying to improve that same approach. This, like many other factors, affects on slower legislation regarding the development of technology.

It is possible that very few global incidents will force the authorities to seriously cope with computer crime, as it was the case with the “ILOVEYOU” virus.

As the development of information technology and e-business is one of the major initiators of social and economic changes, especially in transitional societies such as ours, it is necessary to legally regulate the most important areas – cyber crime and protection of information systems. Lack of adequate regulations will significantly reduce or even completely prevent the development of these areas. The legal framework is the key factor, both to attract new investments and to maintain the existing business environment.

• The reasons for this are manifold:
• it is necessary to have a secure environment and data protection for any activity that involves processing data
• Internet technology, as well as e-business, requires security of data and computer networks
• large companies will not allow sensitive data to be handled in countries without adequate legal framework in terms of protection against espionage, computer crime, attacks on infrastructure or abuse of telecommunications
• necessary are also the laws on data privacy

• Reasonable suspicion and a search warrant

  As the first real problem in all criminal investigations and criminal proceedings, there is a legality in performing the initial search and seizure of evidence by the competent authorities.

  The national law of the United States this issue deals with the Fourth Amendment and its interpretation in criminal law. The Fourth Amendment limits the possibilities to investigators in terms of search and retrieval of evidence. Courts in the United States, regardless of whether the evidence are in electronic or some other form, take care of reasonable expectation of privacy.

  This prevents the search for documents and files on a personal computer of a person without reasonable suspicion. When it is proved that there was reasonable suspicion, and search and seizure were made, the court would dismiss all the evidence collected on that occasion.

  In order for collected evidence to be valid, it is necessary, before investigation starts, to demonstrate reasonable suspicion in this regard and to obtain a valid search warrant. In the case of computers, as well as all other devices in which the information and data are being stored, the term “search” is, in fact, related to a media content analysis.

  As courts across the country have different views on the occasion of a media content analysis, the search warrants issued by them are also different. It is often the case that the prosecution is required to formulate an explicit file types that will be reviewed and analyzed (eg, Word documents and Excel spreadsheets), while other courts allow a complete search and analysis of media content.

  The issue of a search warrant was actually based on an incredibly large amount of information that may include a single media. The potential level of collision and confusion about the rules of expected privacy is very large when you involve the computer in the story. Sometimes search warrant is not needed, not because of an exception defined by law, but because of the absence of a legitimate expectation on privacy by the suspect.

  For example, if a suspect uses a computer that is (publicly) available and not password protected, or at the workplace where it is known that a network administrator can access any computer, it actually rejects all rights guaranteed by the Fourth Amendment because the computer has been used publicly.

  Other questions deal with finding evidence of a third party. In case of failure on the computer, a person brings it to service. Service technician, working on computer, finds incriminating evidence or information and applies it to the competent authorities. Generally, this information would be treated as valid, but in several cases, courts have ruled in favor of the defendant led by the idea that the person that claimed the computer service is not, in fact, abandoned the principle of privacy expected, but allowed access only to the service personnel of the company (United States vs.. Barth, Texas, 1998).

  Although it is necessary to protect the privacy of citizens, as required by the Fourth Amendment, it is also necessary to form a search warrant on the broadest possible manner consistent with reasonable suspicion. This way, investigators will be able to perform the widest possible analysis in accordance with reasonable suspicion of potential incriminating content that will be accepted by the court.

• Search without warrant

  If time and circumstances permit, it is best to go with the search warrant. However, if investigators decide to do the search without a warrant, the search must belong to the one of the exceptions so that the results could be accepted by the court.

  Exceptions are as follows:

  • voluntary consent of the suspect
  • possibility of physical destruction of evidence
  • incriminating content is evident
  • during legal detention

  Although guidelines under which such search is possibleare clear, there is ample room for later rejection of such evidence acquired so that all the investigators are advised to, if it’s possible, avoid this method of trial.

• Relevant acts

  There are numerous laws and amendments that may affect the investigation and which are also related to privacy.

  First of all, privacy act that protects freedom of speech or freedom to publish and placing material on the Internet services. If the material that is collected is protected by First Amendment, then this act affects the search. Of course, there are exceptions when it comes to legitimate results related to the committed crime or potential crime prevention.

  In any case, investigators must approach with caution to any search which material is potentially mixed with that material, which is protected by the First Amendment. The investigator must by all means avoid contact with such material, or else the entire investigation will be declared illegal.

  Another act to be considered, the electronic communications privacy act, which deals with the protection of innocent third parties who keep the stored data, such as Internet service providers. The idea of this law, in fact, is not to protect the company that is the Internet service provider, but the protection of privacy of other users of the company whose data is also stored on servers, along with those data for which there is warrant.

  There are many other acts that must be addressed and that investigators in the civil service must meet in order to their investigation in the court was accepted as a legitimate and legal, and also all the evidence accepted as credible and authentic.

• The authenticity of evidence

  When the digital evidence are found and properly collected, in order to be accepted by the court, the prosecutor must prove the authenticity of the evidence. As a rule 901 (a) FRE “request for authentication or identification is a prerequisite to meet the admissibility of evidence sufficient to support the findings presented by the claimant to introduce evidence.”

  This rule, in fact, requires suit to somehow prove that the digital evidence that is introduced in a case identical to that incriminating which was collected from a computer or some other device of the defendant.

  So, although the digital evidence is collected and analyzed by all the rules, the jury may declare it inadmissible if the prosecutor fails to prove the authenticity of evidence to the court. This standard is the same with traditional documents. Typically, this requires the testimony of someone who has been in contact with the disputed document and who can verify its authenticity.

  In the case of photographs, witness statement that the dispute photograph is a “fair and accurate” picture of what saw is sufficient and the photograph becomes validly introduced evidence. The same thing applies to computer documents. Suffice is someone’s testimony of the structure of these documents to have the basis of evidence authenticity. It does not take a programmer or analyst to testify about the structure of the file itself. It takes testimony of the same content, whereby respecting all previous procedures ensures authenticity of the structure.

• Best evidence rule

  When we take into account both written and audio evidence or photographs, the court sometimes requires original evidence. This requirement is designed in order to prevent witnesses from the misinterpretation of certain materials by relying solely on their testimony about the content. With the development of technology it has become increasingly easy to create identical copies of documents or evidence in general. Best evidence rule states that the question of whether the material is presented in its original form can occur in terms of challenging the authenticity, accuracy or reliability of the evidence, and in that sense, if possible, to present the original material.

  When it comes to digital evidence, technology has enabled the creation of copies in every sense of the faithful original. In this case, presentation of copies is, in principle, acceptable despite the existence and availability of originals. In practice, even preferred presentation of copies in order to avoid any doubt about the possibility of changes to the original. Even the printed form of a digital document is considered valid, except in a case where he can show all information necessary for the process.

• Direct and indirect evidences

  Direct evidence is a fact. Indirect evidence can potentially indicate the fact. A common misconception about digital evidence woud be bringing into question the possibility of digital evidence, in general, to be direct evidence because of its electronic nature. However, even in electronic format, digital evidence can, in any case, prove a fact.

  If we take as an example of bringing into question the security of a computer system, that security can be proved only by digital evidence. Although digital evidence generally indicate only certain human or user, activities or habits, indirect evidence can be equally important in determining some facts, as well as direct evidence. This example is best illustrated by the presence of logs of successful reporting system to a specific user. Direct evidence, in this case, is the record that the account was reported to the system at any given time, however, usage of the warrant that was reported to the system by the particular person is an indirect evidence.

  Misuse or theft of account, as well as the possibility, requires additional proof, which is – only a person may be able to access a computer at a certain time.

• Scientific evidence

  As a new scientific discipline, digital evidence, as well as tools and techniques used to obtain and analyze them, are often subject of scientists’ assessment. Due to the power of science to convince a jury, courts all over U.S. are cautious when it comes to the process of verification of evidence before they accept the results of that process.

  If the review process is at stake, it will affect the admissibility or weight of evidence depending on the situation.

  In the U.S., scientific evidence is assessed using criteria:

  1. 1. Can the theory or technique be tested?
  2. 2. Is there a known high degree of error?
  3. 3. Was the theory or technique publicly published?
  4. 4. Was the theory or technique globally accepted by the relevant scientific community?

  Until now, digital evidence, as well as tools and techniques which have been obtained, withstood every test conducted as scientific evidences. However, examination of any tool or technique, especially the determination of error level, is very difficult and complicated process, not only in digital world. So, in fact, there are no established error limit for most of the forensic examinations. The most reliable way to find possible errors is the re-examination by another, independent investigator using some other tools. In that case, the most reliable is the determination based on the premises set out earlier, and that’s repeatablity of the process of analysis which will verify the reliability of digital evidence.