Crime Scene Training

New Tool for Law Enforcement Executives

Law enforcement executives now have it all in one place: Five critical concepts that are proven to improve policing and save money. NIJ's "Five Things" synthesizes many years of research and distills evidence-based practices that can make a difference into a single list. The list was developed by former NIJ director John Laub and current Police Foundation president (and former NIJ visiting fellow) Jim Bueermann.

Five Things Law Enforcement Executives Can Do to Make a Difference:

      1. Crime is rarely random; patrols shouldn't be either. Focusing on  small geographic locations and times when crimes occur and targeting specific, high-impact repeat offenders can decrease crime.

     2. Quality is more important than speed. In most cases, thorough investigations, problem solving and careful forensic evidence collection contribute more to arresting suspects than shaving a few seconds off of initial response times.

     3. DNA works for property crimes, too. Collecting and using DNA evidence substantially increases the likelihood of solving property crimes -- leading to twice as many arrests and twice as many cases being accepted for prosecution than in non-DNA "traditional" investigations.

     4. In police work, perceptions matter. When people see the police as fair, lawful and respectful, officers are safer and citizens are more likely to obey the law and comply with police orders.

     5. Officer safety and wellness should be a priority. Safety training, certain shift lengths and using body armor prevents injuries and saves lives.

Learn more at the Five Things topic page

Learn when new articles are Posted: Sign up for Email Alerts

  

 

 

 

The quest to crack the world’s most mysterious malware warhead

It was straight out of your favorite spy novel. The US and Israel felt threatened by Iran's totalitarian-esque government and its budding nuclear program. If this initiative wasn't stopped, there was no telling how far the growing conflict could escalate. So militaries from the two countries reportedly turned to one of the most novel weapons of the 21st century: malware. The result was Stuxnet, a powerful computer worm designed to sabotage uranium enrichment operations.

 When Stuxnet was found infecting hundreds of thousands of computers worldwide, it was only a matter of time until researchers unraveled its complex code to determine its true intent. Today, analysts are up against a similar challenge. But they're finding considerably less success taking apart the Stuxnet cousin known as Gauss. A novel scheme encrypting one of its main engines has so far defied attempts to crack it, generating intrigue and raising speculation that it may deliver a warhead that's more destructive than anything the world has seen before. 

Gauss generated headlines almost immediately after its discovery was documented last year by researchers from Russia-based antivirus provider Kaspersky Lab. State-of-the-art coding techniques that surreptitiously extracted sensitive data from thousands of Middle Eastern computers were worthy of a James Bond or Mission Impossible movie. Adding to the intrigue, code signatures showed Gauss was spawned from the same developers responsible for Stuxnet, the powerful computer worm reportedly unleashed by the US and Israeli governments to disrupt Iran's nuclear program. Gauss also had links to the highly advanced Flame and Duqu espionage trojans. 

Gauss contains module names paying homage to the German mathematicians and scientists Johann Carl Friedrich Gauss, Kurt Friedrich Gödel, and Joseph-Louis Lagrange. Its noteworthy features only start there. Gauss has the ability to steal funds and monitor data from clients of several Lebanese banks, making it the first publicly known nation-state sponsored banking trojan. It's also programmed to collect a dizzying array of information about the computers it infects—including its network connections, processes and folders, BIOS, CMOS, RAM, and both local and removable drives.

 But the most intriguing characteristic of Gauss is an encrypted payload that has so far remained undeciphered, despite the best efforts of cryptographers who have already tried millions of possible keys. Tucked deep inside the Gödel module, the secret warhead is loaded onto USB sticks and removable drives when they're connected to Gauss-infected machines. When the drives are plugged into an uninfected computer later, the mysterious code is executed—but only if it encounters the specific machine or machines targeted by the Gauss developers. On every other computer, the module remains cloaked in an impenetrable envelope that prevents researchers and would-be copycats from reverse engineering the code. The extreme stealth has stoked speculation that the payload may contain a potent exploit that could rival the Stuxnet attack that was bent on destroying uranium centrifuges inside Iran's high-security Natanz enrichment facility. Certainly not your everyday malware. 

"Considering the link with Flame and Stuxnet, the payload of Gauss must be of similar magnitude," Costin Raiu, director of Kaspersky Lab's global research and analysis team, told Ars. "Given how careful the attackers were to make sure the Gauss payload doesn't fall into the 'wrong' hands, we can assume it is very special."

Built to last 

Gauss is by no means the first malware with a payload that was programmed to remain dormant unless it was installed on computers meeting a narrow set of criteria. Stuxnet also contained code instructing it to destroy uranium-enrichment centrifuges only when they were physically located at Natanz. Researchers have theorized that the trigger was implemented to reduce the chances of collateral damage that might result if Stuxnet took hold in other facilities. (The precaution proved wise, since Stuxnet infected more than 100,000 computers scattered all over the globe.) 

But as cryptographer Nate Lawson observed more than two years ago, the mechanism Stuxnet used to protect unintended targets from destruction was surprisingly crude for an otherwise advanced cyberweapon developed by countries with almost unlimited budgets. The coding techniques were largely limited to conditional "if/then" range checks that identified computers running German conglomerate Siemens's Simatic Step7 software inside Natanz. If an infected computer met the criteria, the sabotage payload was activated. If not, the exploit sat dormant.

 Noticeably absent from Stuxnet was any kind of mechanism preventing researchers, enemies, or potential copycat programmers from peering inside the malware to see what the highly selective payload did. That's precisely what security experts such as Ralph Langner did following the Stuxnet discovery. Within a few weeks, the world had its answer: Stuxnet was a powerful cyberweapon unleashed by a well-resourced government bent on sabotaging Iran's nuclear program. While the developers may have taken care to prevent the worm from attacking other countries, they did little to conceal the true aim and methods of their malware, which attacked programmable logic controllers at the heart of the enrichment process. 

"Encrypting your payload so that only the intended target can decrypt it hides both the identity of the victim and the worm's purpose," Lawson recently told Ars. "If Gauss came after Stuxnet, it's clear the authors disliked the publicity its PLC [programmable logic controller] payload received and made an effort to hide it properly the second time."

Read entire article HERE

Learn when new posts are made to this blog: Sign up for Email Alerts

 

 

 

 

Understanding What Happens in an Erroneous Conviction

Why are innocent people wrongfully convicted in certain cases yet acquitted in others?

Research is starting to uncover what happens. A new study, "Predicting Erroneous Convictions: A Social Science Approach to Miscarriages of Justice" compared cases where innocent defendants were wrongfully convicted to "near misses" – cases in which an innocent defendant was acquitted or had charges dismissed before trial. They found 10 significant facts that could lead to a wrongful conviction.

Watch an introductory Video Here

        Wrongful Convictions Study

 

 

 

 

 

 

Forensic Technique Offers Hope in Homicides

ANTHONY M DESTEFANO

SOURCE: NEWSDAY

CREATED: MARCH 1, 2013 

Experts say isotopes can eliminate 90 percent of the world in an attempt to identify a homicide victim and have been used to solve European criminal cases.

Canadian police are using an advanced forensic technique to help determine the identity of a homicide victim who may have traveled or lived in the area around New York City in the months before he died in the late 1990s.

 The forensic tool, known as stable isotope analysis, determines the concentration of certain isotopes in the body, which in turn can help show where a victim may have been before death. Isotopes are variations of basic chemical elements and are deposited in hair and bone through food and water consumption.

 Experts say isotopes can eliminate 90 percent of the world in an attempt to identify a homicide victim and have been used to solve European criminal cases.

 Could stable isotopes be useful in the Gilgo Beach investigation, where four sets of remains are still unidentified?

 "Absolutely," said retired detective Paul Dostie, of Mammouth Lake, Calif., who used the method to find the town in Mexico where a still-unidentified female slaying victim came from. "When you don't have a match in a DNA database, you don't give up; you go to other resources like stable isotope analysis."

 Suffolk County Medical Examiner Yvonne Milewski said she was familiar with the isotope technique.

 "We are aware of the use of stable isotope analysis of human remains in human investigations. We cannot comment on the ongoing Gilgo investigations. As a general policy, the medical examiner's office would consider pursuing any scientific method that could potentially provide additional information, and possibly assist in a criminal investigation."

 Asked if her office has ever used the technique, Milewski said through a spokeswoman that it had not been used in any "closed" case and declined to comment further when asked if it was used in any open cases.

 Deputy Chief Kevin Fallon, spokesman for the Suffolk County police department, also said investigators were aware of the isotope method and would use it if it were deemed helpful. However, Fallon declined to comment on whether the method has or is being used in any homicide or missing person case, in contrast to the NYPD and Nassau County police, where spokesmen said their departments had never used it.

 While the Canadian homicide victim, who tests showed was born around 1958, has yet to be identified, police used isotope analysis to narrow down the geographic area where he lived and traveled. The zone is an oval shaped area encompassing Newfoundland in eastern Canada, northeastern Pennsylvania, New York State and New England. The southern edge of the zone includes a fringe of the north Bronx, as well as nearby suburban counties.

 A smaller search area allows police to focus their investigation of missing person databases so they aren't looking for a needle in a giant haystack, said superintendent John House, of the Royal Newfoundland Constabulary.

 "This allows you to make that haystack smaller," said House. "It doesn't eliminate the haystack; it makes it a lot smaller."

 After a photo of a reconstruction of the man's head and face circulated in newspapers in eastern Canada, investigators got a number of calls but no DNA match, said House. Looking for new leads in the United States, House provided the image to Newsday.

 House turned to isotope analysis by contacting Wolfram Meier-Augenstein, an expert in isotopes, at the James Hutton Institute in Scotland. (Police labs can't do isotope analysis in-house.) The science turns on the adage that "we are what we eat," explained Meier-Augenstein in a telephone interview. While isotopes are plentiful in nature, they are deposited in water and food substances at different rates depending on geographic location, said Meier-Augenstein. For instance, North American people consume more corn products than Europeans so the isotope signature for the Carbon-13 isotope would be greater than in a European person, whose primary source of dietary sugar would be from sugar beets.

Global distribution rates of stable isotopes for hydrogen and oxygen can be mapped globally, although there are some variations, noted Meier-Augenstein. Because a person absorbs stable isotopes from food and water, hair will act as a recorder, providing a roadmap about a person's travel and help focus an investigation, he said.

 Copyright 2013 - Newsday

McClatchy-Tribune News Service

Article Source "Officer.com"

For notification when new articles are posted: Sign Up for Email Alerts