Problems in the context of ascription of software to malicious software tools

Abstract

In the course of the research, many scientists dedicated their papers to the issue of combating cybercrime, including the investigation of crimes involving the use of malicious software. At the same time, the role and potential of forensic examination in the domain of ascription of software to malicious software tools remain unexplored.

For several reasons, the author considers that determination of the "harmfulness" of the software, studying nothing but technicality, is dubious and disputed. For example, a harmful action can be performed by a useful computer program due to code error or incorrect launch parameters.

It is also worth noting that there is no direct link between the original purpose of the program and its functionality. The same software (function of the program) can be used both with good intentions and with unlawful purposes. Programs that have the same function can have different basic principles of operation and functionality, and vice versa, programs of different object matter can have similar functions.

In addition, the attribution of the software to malware for snooping and tampering requires the ascertainment of the fact of the author’s intention to create a computer program for this purpose, and also it requires determination of such criteria as "unauthorized," which is legal. The solutions of the legal problems by experts are forbidden by the Criminal Procedural Code of Ukraine (paragraph № 242).

Experience has proven that the initiator of the expert examination usually requires a simple answer of the expert: whether the program is a malicious software tool or not.

According to the author’s judgment, such an approach is fundamentally wrong. Firstly, the expert does not have sufficient capacity to ascertain malicious intent of the software developer, since it requires certain investigation actions (interrogations, etc.). Secondly, addressing both technical and legal issues, the expert actually gives a complete legal evaluation of the offense, thereby assuming part of the investigator’s authority.

In accordance with the author’s opinion, the attribution of software to malicious software (malware) is impossible to implement merely within the framework of forensic investigation. This process demands efforts of both an expert, who explores the technical aspects of the software, and an investigator, who establishes legal points. These legal points concern the possibility, identified by the expert, to apply functionality of software with a purpose of tampering, and also the software developer’s criminal intent to produce a computer program specifically for these actions.