|A High Tech Synergy to Managing the Cyber-sex Offender|
|By Art Bowker, Cybercrime Specialist|
It is no secret that convicted sex offenders are increasing being found online, particularly on social networking sites. In February of 2009, MySpace had reportedly removed 90,000 sex offenders from its site since 2007. (Wortham, 2009) At the end of 2009 New York’s Electronic Securing and Targeting of Online Predators Act (e-STOP) resulted in the removal of 11,721 profiles associated with 4,336 dangerous sexual predators registered in New York. (WIVB.com, 2010) Community corrections officers (CCO) are likewise being increasing tasked to manage the cyber-risk posed by sex offenders. In some departments this translates into prohibiting sex offenders' computer/Internet use. Others take a more progressive view, permitting computer use but monitoring it as well. Usually the later approach centers on either periodic searching of an offender’s computer or the deployment of monitoring software. Each approach has its pros and cons. The more progressive departments recognize the synergy of combining both approaches into their supervision strategies.
Searching a computer can detect noncompliance, including new law violations, that occurred days or even years before the search. The most basic search or preview takes a quick look at the computer on site to determine if there are any issues. Preview searches can be conducted with software or hardware write blockers that prevent any change to the media. They usually are no longer than an hour in duration. Preview searches are not true forensic examinations because they frequently focus only on data that is located in the computer hard drive’s allocated space, such as files listed in a directory. They do not usually retrieve deleted files located in unallocated space. Additionally, they usually do not access system areas, such as Window’s Registry, which can contain important information about the user’s actions. Nevertheless, they frequently will uncover evidence, particularly if done with little warning. Evidence found from a preview search, such as pornographic images, will usually justify taking the computer for a more through forensic examination.
A forensic examination is much more detailed and time consuming. It always involves making a duplicate image of the drive, which can take a significant amount of time, depending upon the drive’s size. The original hard drive is maintained for safekeeping and the duplicate image is then examined. The examination goes beyond just a preview. They include such things as retrieving deleted files and data from unallocated space and examining protected storage areas. It literally can take days or even weeks to complete a computer forensic examination.
Time consuming is just one of the concerns for agencies relying solely on computer searches to detect noncompliance. Proper training and equipment, both of which frequently needs updated, are required to complete computer searches. Offenders who use encryption and/or steganography programs can also defeat or at least minimize a computer search’s effectiveness. Additionally, cleaning or wiping utilities can purge noncompliance evidence prior to a search. Finally, there can be a significant delay in detecting noncompliance even when they are conducted frequently. A sex offender could groom and victimize a minor and/or obtain and distribute hundreds of child pornography images in the days or weeks between a periodic computer search.
Monitoring software can address many of these shortcoming. It can transmit through the Internet keyword alerts, websites visited, and even screen shots of noncompliance. The result is officers can receive timely notification of problem behaviors within minutes of their occurrence instead of depending on the next scheduled search. Some monitoring software can block access to social networking sites and pornographic materials. Additionally, they can restrict Internet use to certain times of day, such as normal working hours.
Monitoring software can also overcome encryption, steganography, and wiping utilities. It does this by recording everything, including the incriminating evidence and the offender's efforts to conceal or destroy it. Even removing and destroying the hard drive can be futile for the offender because some monitoring software forwards the evidence to a secure server, beyond their reach.
Monitoring software is not without limitations. It can not detect violations that occurred before it was installed. Additionally, it only works on a computer it is installed on. Monitoring software also can not always be installed on all Internet capable devices, such as cell phones and gaming systems. Additionally, it can be circumvented by technically sophisticated offenders. Finally, remote receipt of noncompliance requires that the target computer be connected to the Internet.
Conversely, the ability to conduct computer searches overcomes many of these limitations. Searching a computer before monitoring software is installed will insure the offender does not already have pornography or sexually explicit stories (FieldSearch is an excellent free tool for this purpose). Unauthorized computers discovered can be subjected to a search. Likewise, digital devices, such as cell phones and gaming systems can be searched as needed.
This article has hopefully raised awareness of using computer searches and monitoring software to supervise the sex offender. Each have pros and cons. However, embracing both these approaches will overcome their limitations and provide the right synergy to managing the cyber-sex offender.
About the Author
Art Bowker has over twenty four years experience in both corrections and law enforcement at the state and federal levels. He is currently the Secretary of the High Technology Crime Investigation Association (htcia.org). Art also has a Master of Corrections degree from Kent State University. Follow Art on Twitter.com at: (http://twitter.com/Computerpo)
WIVB.Com (2010). “Sex Offenders Removed from Social Sites: E-STOP Law Results in Removal from Websites” LIN Television Corporation. February 2, 2010, Retrieved February 8, 2010 from http://www.wivb.com/dpp/news/new_york/Sex-offenders-removed-from-social-sites
Wortham, Jenna (2009). “MySpace Turns Over 90,000 Names of Registered Sex Offenders” New York Times. February 3, 2009, Retrieved February 8, 2010 from http://www.nytimes.com/2009/02/04/technology/internet/04myspace.html
IN CASE YOU MISSED IT