Crime Scene Training

Digital Evidence – From Crime Scene to Court Room Part 1

Introduction

Evidence Collection Constraints

Keeping up with the criminal element is an on-going challenge for the legal system in the USA. As more and more fantastic advances are made in digital technology, the cyber-criminal seems to grasp this new technology and adapt it to illegal use before the criminal justice participants have the opportunity to study and understand it.

The front line law enforcement agencies, prosecutors, and judges are often overwhelmed by the amount of information required to keep pace with the ever-evolving changes involving computers and their associated hardware, software and operating characteristics. The criminal element continually alters, revises, or creates hardware, software, viruses, malware, and other attacks in an effort to mask criminal activity and prevent detection. As if keeping up with digital technology isn’t enough, the criminal justice system must keep pace with the latest revisions and modifications of existing laws and push legislatures and the congress to create new laws as each new cyber-threat appears.

While computer technology has been with us for nearly 60 years, our problems really began in the late 1980s. An example of how this technology has leap-frogged along includes child pornography cases where evidence appeared mostly in underground magazines consisting of photographs, 8mm film and videotapes. But in the mid-1990s, the Internet began its evolution and brought with it significant change. Now it is unusual to find child pornography that involves anything other than digital images and hardcopies of those images.

Once the province of “computer crime” such as hacking, digital evidence is now found in virtually every crime category. But all too often law enforcement agencies and the judicial system are ill-prepared to deal with the issues created by the increasing use of cyber-technology.

Specially trained and experienced investigators should not assume that prosecutors fully grasp the problems they encounter in the recovery and analysis of digital evidence. Thus… the burden for education must be borne equally by prosecutors, investigators, and examiners who are obliged to share their knowledge of the technical complexities and map strategies.

 Search and Seizure

The collection of digital evidence in criminal cases falls under the Federal and State levels by myriad constitutional and statutory requirements, including those laws regulating the communications and computer industries and that directly detail the collection and use of digital evidence. Previous court decisions and procedural rules established to implement them also need to be included.

The Privacy Protection Act (PPA) (42 U.S.C. § 2000aa et seq.) limits law enforcement’s use of a search warrant to search for or seize certain materials possessed for the purpose of public dissemination. The protected materials may be either “work products” (i.e., materials created by the author or publisher) or “documentary materials” (i.e., any materials that document or support the work product).

For example, a person who is creating an online newsletter may possess interview notes that could be considered “documentary materials”; the text of the newsletter to be published could be considered a “work product.”

If the material is covered by PPA, law enforcement cannot use a search warrant to obtain it.

PPA’s prohibition on the use of a search warrant may not apply when:

• Materials searched for or seized are “fruits” or instrumentalities of the crime or are contraband.
• There is reason to believe that the immediate seizure of such materials is necessary to prevent death or serious bodily injury.
• There is probable cause to believe that the person possessing the materials has committed or is committing a criminal offense to which the materials relate. (Except for the possession of child pornography and certain government information, this exception does not apply where the mere possession of the materials constitutes the offense.)      

Of course, the criminal justice system must also consider constitutional issues as well. Searches for digital evidence, like searches for other forms of evidence, are subject to the constraints of Federal and State constitutional search and seizure laws and court rules. Traditional Fourth Amendment principles, such as those governing closed containers, apply to digital evidence.

Additionally, there is the issue of privileged information:

In some instances, law enforcement may have reason to believe that the place to be searched will contain information that is considered “privileged” under statute or common law (e.g., the office of a lawyer, health professional, or member of the clergy). Before drafting a warrant and conducting the search, law enforcement should take care to identify and comply with the legal limitations that the jurisdiction may impose. Law enforcement also may wish to:  

• Consider the use of taint teams (also known as privilege teams), special masters, or another process, as approved by the court.
• Consider in advance whether the media to be seized contain privileged or proprietary information.
• Consider obtaining a stipulation before seizing information from the target to avoid confiscating potentially privileged or proprietary information. (See appendix D, “Stipulation Regarding Evidence Returned to the Defendant,” for an example.)
• To avoid tainting the acquisition of evidence, ensure that the prosecution team addresses the issue of privileged or proprietary information when drafting the search warrant.

Handling traditional forms of physical evidence has resulted in specific guidelines that have been a part of crime scene protocol for a considerable time, but maintaining the integrity of digital evidence throughout the examination procedure presents different problems. Some common problems are further complicated by the complexity of networked computers. This text assumes that the seized media contains relevant information and that the forensic procedures used to examine that media have not altered the evidence from the time it was seized. After seizure, ensuring that the traditional chain of custody remains unbroken is necessary but not sufficient to establish the authenticity of the data or evidence obtained from the forensic examination. Additionally… the traditional chain of custody and its associated precautions may be required for examining digital evidence.

An additional concern is that the examination of digital devices be accomplished through the use of tools recognized and accepted by the forensic community. Because the process used to acquire the data is itself electronic, both the evidence and the process may be subject to legal challenges. Additional expert testimony may be required to authenticate the machine, applications, and forensic tools.

Both for purposes of admissibility and persuasive value of digital evidence, the prosecutor must show to the court that the information obtained from the media is a true and accurate representation of the data originally contained in the media, irrespective of whether the acquisition was done entirely by law enforcement or in part or entirely by a third party of civilian origin.

Thorough and accurate documentation of the evidence is critical. It is essential to establish both admissibility … and the persuasive force of the evidence. A well-documented case is much more likely to result in a guilty plea, saving valuable prosecutorial and court resources. (Previous test) describes the information that law enforcement should gather to document what happened with respect to the data before seizure. Law enforcement also must thoroughly document its own actions with respect to the data. Documentation should include the steps taken to acquire, examine, and store the data.

With respect to examination notes, keep the following in mind:

• Comply with agency policy with regard to preparation and retention of notes.
• Be aware that retained notes and other records may be discoverable. The prosecutor must be notified and given an opportunity to review them.
• Do not commingle notes from different cases.

Italicized segments in this article are verbatim from the NIJ Manual, “Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors.”

 To keep up to date on new posts to this blog: Sign up for Email Alerts        

   

BloodTips-05 – BLUESTAR FORENSIC KIT

Introduction

New to SIRCHIE's line of Blood Search Reagents! The BLUESTAR Forensic Kit affords the crime scene investigator a complete tool to determine the presence or absence of blood. The extreme sensitivity of BLUESTAR allows the detection of bloodstains down to 1:10,000 dilutions, including minute traces that have been visibly washed off, with or without detergent. (Tub with blood stains)

 Unlike other blood reagents, total darkness is not always required. Subsequent DNA Profiling and ABO Typing is possible because BLUESTAR does not alter the DNA in suspect blood stains.

Reaction-False Positives

When reacting with blood, the BLUESTAR® FORENSIC latent bloodstain reagent emits an intense blue-white chemiluminescence in the range of 420 to 440 nanometers. Keep in mind, however, that "false" positives may occur due to the presence of many common household detergents, chlorine (from bleach), certain paints and varnishes, copper (from plumbing), certain iron-metabolizing plants like lichens, thyme and some tree mosses, and certain soils rich in iron. 

Such "false" reactions are easily identifiable by the trained technician because their color, brightness, and duration of chemiluminescence differs from those of the typical reaction from blood. Typically, "false" reactions offer markedly dimmer chemiluminescence and are whiter in color. "False" reactions due to chlorinated detergents are often worth a second look, because they may reveal attempts to wash or clean up bloodstains, and to conceal crimes of violence. 

Photography

Photography of latent blood prints developed and visualized from chemiluminescence is not fundamentally different from regular daylight photography. The same basic elements of photography apply: subject lighting, ISO setting, aperture setting, and shutter speed) interact in exactly the same way. Photography of BLUESTAR® FORENSIC detected blood prints is easy and produces excellent results. 

Equipment

The chemiluminescence produced by the reaction of the BLUESTAR® FORENSIC latent bloodstain reagent to blood is bright enough that, most often, no special equipment is needed. However, relatively long exposures may be needed for maximum photo quality and a tripod and flexible cable release are highly recommended in order to maintain stability of the camera, which must remain motionless during the time of the exposure. A wide-angle lens is recommended. 

Use at the Crime Scene

BLUESTAR offers different kits so by all means follow the specific recommendations supplied with the kit you will be using. Shelf-life of BLUESTAR after mixing is limited to a maximum of 24 hours. When mixing the tablets in the carrier solution, do not shake or invert the sprayer. Rather… swirl the sprayer until the tablets are dissolved.  (Blood Print on Tile ===>)

Safety Precautions

As with handling any chemical, use Best Practices during the application of the spray. Wear latex gloves, safety glasses or goggles, dust respirator and protective clothing.                                                                                                                            

Final Word

Chemical field tests are considered “Presumptive” in determining the nature of the substance tested. None of the bloodstain reagents explained in this, or preceding articles in this series of “BloodTips” offer definitive proof that the tested substance is blood. The final determination must be made in the crime laboratory. Best practices and agency protocol dictate that samples of the substance tested are to be collected for scrutiny in the lab. 

To receive notification when new articles are posted on this blog: Sign up for Email Alerts

 

“Like” us on Facebook                                             Watch the BLUESTAR Video

 

Basic Stages for a Crime Scene Investigation—Possible Homicide

By: Don Penven

Approaching the Scene:

The crime scene investigator returns the microphone to its clip and begins the drive to the latest assignment.  A crime scene investigation begins well before the CSI enters a structure, an open field   or wooded area. Usually the radio dispatch message is brief and seldom reveals the full nature of the incident. Most often this is done to avoid drawing on-lookers and the media who may be monitoring the dispatch frequency. As the CSI turns onto the street in question, his first obligation is to “turn on” his powers of observation. He may make a mental note of what he sees, hears and smells—or better still—records them on a digital voice recorder. His first reaction to the scene must be, “Does anything look out of place? What odors may be noticeable and are there unusual sounds.

Secure and Protect the Scene

Hopefully the first responders haven’t caused too much disruption to any potential physical evidence. Before even stepping inside the structure, ingress and egress to it must be controlled. Sentries at all possible entrances should be put in place. The CSI, after learning the basic facts—in this case it appears that a white male appears to have a single bullet wound the head and rigor has set in-- this from the first responders, so the CSI will establish the boundaries of the crime scene. Then… out comes the crime scene tape.

 Initiate Preliminary Survey

Again… before entering the structure an exterior survey is needed. This may be nothing more that walking around the exterior of the structure to see if any obvious evidence is apparent. This would include open windows, damaged doors, ladders and the like. The question the CSI is asking is… how was entry made to the structure?

Once indoors, the CSI will make a visual survey of the actual room in which the incident reported took place. This is a good time to also take overall photos of the scene. He will then survey adjoining rooms to determine if these spaces may have information relative to the incident.

Most law enforcement agencies conduct such investigations of an unattended death (no physician present) as a possible homicide—until it is determined otherwise.

Unlike some TV dramas, the CSI is on site for the purpose of finding, evaluating and collecting physical evidence. In most agencies, statements from witnesses and survivors are handled by the investigators/detectives.

Of course, during this entire survey period, the CSI is taking notes and/or recordings of his sensory observations.

Evaluate Physical Evidence Possibilities

The very nature of what appears to be obvious should trigger the thought-processes of the CSI. What happened here, when did it happen and what sort of evidence should be present? Questions that should be answered initially are:

• Did the shooting occur in this room
• Has the body been moved (by first responders or perpetrator(s)
• Has any object been moved (especially by first responders or family members
• Were additional shots besides the one in the victim’s head. This means examining walls, ceiling, room objects, etc.
• Are shell casings apparent. If so—mark them with placards, evidence tents, etc. so they will be obvious in photos.
• Are traces of blood apparent in other areas of the room—indicating movement of the victim
• Is blood spatter apparent
• Are there signs of a struggle
• Are there visible footprints in the blood

Each crime scene may well generate other questions to be answered by the CSI. The above list is simply the most obvious questions.

Prepare a Narrative of the Scene

The CSI’s notes can serve as a very critical part of the overall physical evidence available from the scene. The investigator must keep in mind that months or even years later this case may go to trial. Your notes must present the full story of what you saw and any impressions the evidence gave you. Avoid speculation as to what occurred unless you have physical evidence to back it up. 

Capture the Scene Photographically

Be certain to have overall, medium range and close-up shots of any potential physical evidence. Be certain to include scales in the close-up shots. 

Prepare the Crime Scene Sketch

Many CSIs will prepare the rough sketch at the scene and will complete a detailed sketch back at headquarters. The rough sketch should contain no more or no less than the final, detailed sketch. It is always recommended that an assistant help out when taking measurements, and it’s a good idea is to have this individual verify each measurement to avoid questions later. 

Conduct a Detailed Search

Go over every square inch of the scene in an attempt to locate even the smallest particle of evidence. (This brings to mind a recent case wherein a woman was brutally beaten to death in her bedroom. Several days after the crime scene was released to the family, the victim’s sister found a tooth from the victim on the bedroom carpet).

Many crime scenes warrant the use of an evidence vacuum in the scene to collect any potential microparticle evidence such as hair and fibers. This step should be performed prior to any close in inspection of the victim. 

Record and Collect Physical Evidence

As potential evidence is located it should be recorded on the crime scene sketch as well as in photographs. If your agency offers the luxury of having a videographer on hand, video often tells a compelling story to a jury.

Crime scene evidence is useless unless it is properly marked and packaged and a Chain of Evidence is begun from the time it is picked up. Use the proper type of containers for all evidence collected. Never package objects wet with blood or other physiological fluids in plastic bags, as this will accelerate decomposition. Label and identify all evidence collected, including the notes taken by the investigator.

Of course, the digital age we live in takes note of electronic devices like computers and cellphones.  This type of evidence requires special handling and only experts trained in working with digital items should be permitted to handle and collect these items. 

Conduct a Final Survey

Be certain that every package containing physical evidence is collected—leave nothing behind. Make a final walk-through to be certain that all potential evidence is bagged and tagged. 

Release the Crime Scene

While it is normal for others having an interest in the property to want to regain access, the CSI should not be rushed, coaxed or bullied into releasing the scene until the job is done.

This website is populated with articles of interest to the law enforcement community and we encourage your feedback. Use the Comments Section below to give us your personal impressions of the information contained here. 

To learn when new posts are published: Signup For Email Alerts HERE

Join us on Facebook

Clan Lab – Synthetic Cannabinoids

Toward the end of June, 2012, a joint operation between the Palm Beach County
Sheriff ’s Office (Narcotics) and the DEA Palm Beach Resident Office successfully
raided and dismantled a clandestine laboratory for synthetic cannabinoids.
The following is a series of pictures which have been shared in order to help educate law enforcement across the country on the ease of manufacturing synthetics and some of things you should be watching for in your fight against these labs.

This series of pictures gives you an excellent overview of the simplicity of the lab.
Now for the revenue associated: A typical lab will have an annual cost of $200,000.00 in materials for manufacturing. This translates into $.50 per package of substance.

DOWNLOAD YOUR COPY TO SEE ACTUAL PHOTOS: NARK News Volume 4.

Behavioral analysis in the interrogation room

From Police One (By: John Bowden)

If you fall into the mindless routine of following the “enumerated process” you will miss the subtle hints that take you to the confession

Encarta Dictionary defines behavior as, “The way something behaves.”  Analysis is defined as, “The examination of something in detail in order to understand it better or draw conclusions from it.” Behavioral analysis is simply the observation of behavior and then analyzing that behavior to determine its meaning.  In the process of observing behavior we make the following assumption.  In living organisms there is a “cause” which is the impetus of the “behavior” — that behavior has a “purpose or meaning.”

 In observing this process, we try to determine the connection from “cause” to “behavior” to “purpose or meaning.”  The cause can be initiated either internally or externally.  Hunger would be an internal cause.  This would cause the behavior of seeking food.  The purpose of the behavior is to obtain food for consumption.  An external cause would be a speeding car approaching a person in a cross walk.  The behavior would be to move out of the way.  The purpose would be for survival.  Knowing the cause of the behavior can reveal the internal, mental processing of the subject.  For instance, you inform a subject that you know they are the one that committed the offense.  When we say this, the subject jumps from the seat of the chair and immediately sits back down. That behavior is caused by the adrenaline rush caused by shock of the accusation. The meaning of the behavior helps to confirm that this subject is the perpetrator.

 Behavioral Analysis gives us the “cause” of the “behavior” as well as the “purpose” or the “meaning.”  Knowing the cause and the meaning can guide our investigation. 

The Coordinated Behavioral Response is an investigative philosophy where the investigator responds appropriately to the behavior exhibited by the subject.

Throughout history researchers have studied behavior trying to analyze the cause and effect of human behavior.  It has been studied by researchers in psychology, sociology, criminology, anthropology, management and other fields of study. Behavioral Analysis is used in a variety of occupations.  The business community uses behavioral analysis in the screening of new employees.  They ask business related questions and analyze the responses of the potential employees.  It is used by promotion boards to determine the best candidate for advancement.  Psychologists and psychiatrists use it in the treatment of their patients.  The FBI Behavioral Analysis Unit uses it to evaluate the behavior of psychopathic and sociopathic criminals to determine their personal characteristics to aid in their identification and capture.

Coordinated Behavioral Response

In interviews and interrogations the classic use of behavioral analysis is to determine the truth or deception of a subject’s responses.  If a person is telling the truth they did not commit the offense.  If they are deceptive they are the perpetrator, had a part in the offense or know the perpetrator.  This is a valuable tool in the arsenal of the investigator — it is only one of many uses of behavioral analysis.  The analysis of a person’s behavior tells us more than if they are guilty or innocent. A subject’s behavior informs us of the subject’s state of mind — do they like or dislike us — do they like or dislike other people in the case: are they holding back — are they ready to confess — are they trying to make an admission — are they ready to or want to leave — as well as other states of mind.  This knowledge of their state of mind can guide us in our response to their behavior.  Our response is specifically calculated to match up with the subject’s mental state in order to obtain the information about the case leading to its resolution.  This response is called a Coordinated Behavioral Response. 

In the interview and interrogation process we are taught to start at the interview of the victim and progress to the confession.  The interview or the interrogation is not a set of defined steps you must follow.  There are critical stages you should recognize and respond to in a particular fashion.  However, they do not always occur in a particular order.  The subject of “Interviews and Interrogations” is often taught as an “enumerated process”, usually beginning with the interview and progressing to the confession.  Many texts and articles on interviews and interrogations have been written about these ordered processes, putting them in steps, stages, phases, segments, levels, parts, periods, chapters, divisions or ordered tasks. 

In fact, this type of instruction will start off with an introduction stating the number of steps in the process.  For example: “The interview and interrogation process consists of (5, 7, 9, 11 or whatever number of steps).” 

This is usually followed by giving each step a name.  The instruction will start at step 1 and take you through the ordered process.  In her research, Ellen Langer has shown the learner will subconsciously adhere to this proscribed, ordered list, not recognizing that any of these stages can occur at any time during the interview or interrogation. This learned process hinders the investigator’s ability to adapt to irregularities or variances in the interview process. The investigator should recognize there is not one ordered process to be followed — instead, there is a myriad of potential possibilities that might occur. The investigator must be prepared to respond appropriately to the behavior that is presented by the subject. The investigator does not try to force an “enumerated process” but instead responds with a “Coordinated Behavioral Response.”

 The “Coordinated Behavioral Response” is the recognition of the subject’s behavior and then responding in a fashion designed to move the investigation to its resolution, a confession.  The response is one that is correct for the behavior that is observed.  The investigator is always working to move the subject to the confession.  However, the investigator must respond correctly to the subject’s behavior. 

For instance, you sit down to interview a subject in a theft case.  The status of the subject is as of yet undetermined. The subject may be a witness, an uninvolved employee or the perpetrator of the theft. Initially you may be prepared to conduct an exploratory interview to determine the subject’s possible involvement. When you introduce yourself, the person goes into the confession position and starts crying. Using the “Coordinated Behavioral Response” you would recognize this and respond accordingly, without any intervening steps.  Suppose the same person made a small admission, apologizing for the missing money.  Again, using the “Coordinated Behavioral Response” you would respond to the admission.  Perhaps during the initial interview the person behaves erratically, displaying the mannerisms that indicate deception.  Using the “Coordinated Behavioral Response” you would respond by moving into a subject identification interview that will reveal the subject is lying and is the perpetrator.  From there you may move to the interrogation or return after interviewing other subjects associated with the case. 

In another scenario, you enter the room and introduce yourself.  You explain to the subject why they are there and you would like to chat with them about what happened.  As the conversation begins, the subject starts to make excuses for what has happened, emphasizing it could happen to anyone.  You recognize this person has moved into the beginning of the interrogation phase.  The difference to the normal model is that the subject is introducing the interrogation strategy, as opposed to you introducing it.  Using the “Coordinated Behavioral Response” you should recognize the beginning of the interrogation strategy, regardless of who started it.  You would respond appropriately, agreeing with the subject that these things happen, taking their side and continuing on with the strategy the subject has selected.  This would naturally lead to an admission and on to confession — or it may go immediately to the confession. 

Be Vigilant for Subtle Signals

In the “Coordinated Behavioral Response” process you respond according to the stage the subject has presented.  The important point to remember is to avoid being trapped in a mindless process where you first do “A,” then “B,” then “C,” and so on.  If you fall into the mindless routine of following the “enumerated process” you will miss the subtle hints that take you to the confession.  An episode of COPS I once saw offers an example for consideration.  An undercover drug squad move in and serve a search warrant on group of drug dealers in a house.  The search warrant was for a large cache of drugs being stored in the house.  The team moved in with cool precision.  It was early in the morning and all of the occupants of the house were asleep — some in the bedroom and others in the living room. 

The ring leader of the group was a woman I will call “Maggie.”  After the team entered and secured the scene, they moved everyone to the living room.  As they searched they were able to only find a small amount of drugs, not near the amount they were looking for.  While the team was searching the team leader was talking to the subjects in the living room, particularly to Maggie.  She claimed to have no knowledge of any drugs.  The team leader refused to believe her and began to accuse her, telling her he knew she was dealing, he knew she had a “bunch” of drugs hidden in the house.  He went on to state she could not fool him — he knew what was going on.  Maggie was standing handcuffed in the living room. 

The team leader was pacing back and forth as he ranted not closely watching Maggie.  As he continued to speak and accuse Maggie, she gave a big sigh, her face went to a sad expression, and her head dropped forward.  Her shoulders drooped and she began to nod her head in agreement to what the team leader was saying.  He continued on, not picking up on her confession position and expression of submission.  As he continued, Maggie straightened up, the sad expression gone. 

The team arrested Maggie and the other members of the group for drug possession and a number of other charges they had already established in previous buys.  The big cache was never found. In the post interview on camera the team leader was disappointed he did not get the large amount of drugs he had hoped for, but considered it a success because of the arrests that were made.  I find this to be an example of mindless procedure on the part of the team leader.  He was not in an interrogation room — he had not established the interrogation process and therefore missed the confession position of Maggie.  Had he been attuned to her behavior and responded to her with a “Coordinated Behavioral Response,” I feel he could have obtained a confession from Maggie and possibly the location of the drugs. 

As you speak to the subject, monitor the subject’s behavior, determine their stage in the process and respond with the appropriate “Coordinated Behavioral Response.”  Remember, “The correct behavioral response will cause the subject’s poor tortured soul to pour out on the table in front of you.” 

My new book “Interview to Confession, The Gentle Art of Interrogation” presents the methods to establish a rapport and guide the person to a confession.  It presents a new concept called the “Coordinated Behavioral Response,” a method that gets away from the standard stepped investigative process currently taught and used today.  The “Coordinated Behavioral Response” is an investigative philosophy where the investigator responds appropriately to the behavior exhibited by the subject, whether they are a victim, witness or suspect, to gather information and solve a case.

PoliceOne Article

To receive notice when new articles are posted: Sign Up For Alerts

Join US on Facebook

 

Forensic Scientist Tracks the Crime Scene Invaders

FORENSIC ENTOMOLOGY 

Forensic Scientist Tracks the Crime Scene Invaders

ScienceDaily (May 11, 2012) — Marks on a dead body could indicate violence and therefore murder. But they might have been made by legions of insects. A forensic scientist has built up data that will be a big aid to detectives faced with investigating gruesome discoveries.

A forensic scientist is unmasking the planet's tiniest criminals -- minute creatures who contaminate crime scenes and threaten to throw detectives off the scent.

Italian-born Dr Stefano Vanin, who lectures at the University of Huddersfield in the UK, is making valuable discoveries which will enable crime scene investigators to determine whether injuries to a body or damage to a corpse's clothing were caused by a human killer... or were the work of insects which moved in after death had taken place.

Very often, says Dr Vanin, tiny creatures can cause lesions to a dead body which closely resemble injuries left by a human assailant. For example, ants which clamber over a corpse's face can deposit marks which mimic the effects of a punch.

It is vital that detectives are quickly able to separate post-mortem insect damage from wounds that were caused before death by a killer.

Dr Vanin is building up a body of knowledge about the various ways in which insects can distort crime scenes and he reports on some of his latest findings in the journal Forensic Science International. This time he investigates the damage caused to dead bodies that are found underwater, where they are preyed on by aquatic creatures.

It was the retrieval of the body of a 28-year-old man in the River Brenta, at Padova in Italy, that provided Dr Vanin with the opportunity to add another piece to his jigsaw of knowledge.

The man had drowned -- witnesses had seen him struggling in the water -- and there were no signs of injury on the body. But during the autopsy a series of small abrasions in the upper eyelids were discovered.

These were caused by large numbers of amphipods -- tiny, eyeless crustaceans which had been feeding on the body and were discovered when the corpse was pulled out of the water.

This enabled Dr Vanin and his colleagues to analyse and record the post-mortal damage caused by the amphipods. The marks were very similar to those deposited by ants on dry land.

As a result, when detectives and forensic scientists are examining future corpses recovered from fresh water, they will have data which will help explain unusual markings on the body.

Get notification when new posts are made: Sign Up for Email Alerts

JOIN US ON FACEBOOK

US Cyber Chief Accuses China of Targeting Pentagon

Reuters: 10/1/2012

Cyber Command intelligence chief says attacks accelerating

* Plans under way to promote Cyber Command to top-level unit

 * China accused of seeking to "exfiltrate" Pentagon secrets

 By Jim Wolf 

WASHINGTON, Sept 27 (Reuters) - The U.S. Cyber Command's top intelligence officer accused China on Thursday of persistent efforts to pierce Pentagon computer networks and said a proposal was moving forward to boost the cyber command in the U.S. military hierarchy.

"Their level of effort against the Department of Defense is constant" while alleged Chinese attempts to steal corporate trade secrets has been growing, Rear Admiral Samuel Cox, the command's director of intelligence, told Reuters after remarks to a forum on the history of cyber threats.

 The Office of the National Counterintelligence Executive, a U.S. intelligence arm, said in a landmark report a year ago that "Chinese actors are the world's most persistent perpetrators of economic espionage."

 "It's continuing apace," Cox said. "In fact, I'd say it's still accelerating." He accused China of trying to "exfiltrate" Pentagon secrets, jargon for sneaking them out.

 Asked whether any classified U.S. networks had been successfully penetrated - something not publicly known to have occurred - Cox replied: "I can't really get into that."

 A spokesman for the Chinese embassy did not immediately respond to a request for comment. In the past Chinese officials have denied such accusations.

 Cyber Command is responsible for defending Defense Department networks as well as mounting any U.S. offensive operations in cyberspace. It was created about two years ago as a unit of the U.S. Strategic Command, the outfit responsible for U.S. nuclear and space operations.

 Cox said a proposal was moving forward to elevate the cyberwarfare unit to the status of a full unified combatant command. This would put it on the same footing as its parent Strategic Command and the Defense Department's eight other top-level military units.

 The matter was headed to the secretary of defense and the president for a decision that possibly would come by the end of the year, he said.

 Cox spoke after telling a conference hosted by the Atlantic Council think tank that the overall sophistication and danger of cyber threats is increasing at "an accelerating rate, not a linear rate."

 "So the potential for these things to do destructive damage is very high," he said.

 The United States is among the few countries reliably reported to have mounted a destructive keyboard-launched attack - against Iran's disputed nuclear centrifuges using malicious code known as Stuxnet that surfaced in 2010.

 Army General Keith Alexander, who simultaneously heads Cyber Command and the National Security Agency, told a forum in July that unspecified foreign countries, hackers and criminal gangs contributed to a 17-fold jump in cyber attacks on U.S. infrastructure from 2009 to 2011.

 Promoting Cyber Command in the military hierarchy would simplify its operations in cyberspace and boost its ability to work directly with U.S. government agencies, allies and coalition partners.