Noora, you presented a paper on the challenges of investigating cyberstalking at DFRWS. Tell us a bit about your research and what you found.
The research combined the techniques of Digital Forensics with the strategies of Behavioural Evidence Analysis in investigating cyberstalking cases. It aimed to examine the utility of this approach in terms of understanding the behavioural and motivational dimensions of offending, and the way in which digital evidence can be interpreted. It used this approach on 20 cyberstalking cases investigated by Dubai Police in the last five years and reported on the results of the examinations.Results showed that utilizing this multi-disciplinary approach has many benefits in investigating cyberstalking cases. It helps to focus an investigation and provides investigative directions, enables better understanding and interpretation of victim and offender behaviour, helps identify potential victims, and assists in inferring traits of the offender from the available digital evidence. These benefits can help investigators to build a stronger case, reduce time wasted on mistakes, and to exclude suspects wrongly accused in cyberstalking cases.
What was it that first sparked your interest in digital forensics as a field?
The field of forensic science always intrigued me. My uncle was an expert in DNA forensics, and I always looked up to him and was fascinated by his work. In 2002 I graduated from university (majoring in Information Systems) and was offered a job at the criminal laboratory, which I took straight away. At that time, they had just established the Computer Crimes section, which had only one person running it. I asked to join the section and by working with the head of the section, we gradually built it up and expanded it into the current Department of Electronic Evidence. During that time, I also decided that I needed to pursue a higher degree in the field of Digital Forensics. As such, I got my Masters degree in Cyber Security and Digital Forensics, and am currently working to pursue a PhD in the same field.
What are some of the main challenges involved in investigating cyberstalking?
In traditional stalking a person is repeatedly monitored, followed or harassed with unwanted and obsessive attention. In cyberstalking, however, another dimension is added as offenders exploit technology to cyberstalk their victims, which provides another avenue for abuse. Offenders use technology to hide their identities, create multiple online personas, and destroy evidence of their online trails and activities, which adds to the complexity of investigating these cases. Offenders do not have to be within the same geographical area as the victim. They can cyberstalk their victims while being in another city, country, or continent, presenting jurisdictional issues for investigators and prosecutors.
As such, investigating cyberstalking cases involves many challenges. Some of them include accessing information that is stored in the cloud, and tracing the cyberstalking pattern when data anonymization and obfuscation techniques have been employed. There is also the challenge of attributing ownership to electronically stored information, and to expediently locate relevant information amongst large sets of data. Also, these cases frequently involve victims who are unable to articulate the time line of events and facts of the cyberstalking properly, which makes it difficult to reconcile them with the time line and facts found from the electronic evidence.
In your opinion, why is it so important for digital forensics and behavioural analysis to work together?
I believe that behavioural analysis complements the existing standard practice of digital forensics, especially in cases involving interpersonal crimes such as cyberstalking. Integrating the strategies of behavioural analysis within the technical examination of digital evidence can yield better results as it facilitates a more in depth understanding of the dynamics of the specific crime. It helps interpret the victim and offender behaviours, get an insight on what motivated the offender, understand what might have put the victim at risk of victimization, and assess the credibility of the situation and the risk that an offender is likely to physically harm their victims or themselves.
In many of the cases, offenders leave indications of certain distinctive behaviours in the virtual crime scene (e.g., computer, smart phone, etc.) that can be inferred from the digital evidence. Behavioural analysis can help infer these distinguishable traits of the offender, which can then be used to further inform the investigation. This helps the investigator to have a more detailed understanding of the offending behaviour, which can aid in identifying relevant evidence and its correct interpretations. This can then be used to create a more solid reconstruction of the crime that helps in providing an explainable basis for expert judgment and opinion.
Some people in the digital forensics community are skeptical of the usefulness of 'softer' scientific investigative methods such as psychological profiling. What do you think can be done to address this?
I think that more research must be done on this issue; especially empirical research, to present the benefits of integrating these methods within the digital forensic investigations. I also believe that designing models that clearly describe the way in which these methods can be applied within digital forensic investigations of certain digital crime categories would make useful references for investigators. It would provide them with an idea of the benefits of these methods and how they can be properly utilized in investigating specific digital crime.
Do you have any advice for people who want to study digital forensics? What is it that makes a good researcher in this area?
I think that passion is the best driver for those who want to study digital forensics. Having a curious mind, a capacity to learn, a desire to become an expert in the field, and some patience would make a successful researcher in this area.
Finally, when you're not working, what do you like to do in your spare time?
When I have some time, I like to spend it with my family, go for a swim to clear my mind, or read mystery novels. Also, I would always appreciate having a cup of coffee in the afternoon with a close friend.
Noora Al Mutawa is an Expert in Electronic Evidence and the Head of the Computer Examination Section at Dubai Police's Department of Digital Forensics.
Forensic Focus interviewed Noora at DFRWS, the annual Digital Forensics Research Workshop, which took place in Lausanne from the in March. The next workshops will be held in Seattle in August 2016, and Germany in March 2017. You can find out more and register here.