[unisog] Suspicious Files

Joshua Krage jkrage at guisarme.us
Tue Dec 9 06:32:53 GMT 2008

4th Amendment most likely doesn't apply as the student voluntarily turned
over the computer and asked for assistance.  Law Enforcement can usually
accept anything under the Best Evidence guideline.

Given the variety of Education-related issues such as internal policy and
previously-set expecations via formal communications, legal issues at local
and state levels, your best *legal* guide will be your legal office.  You're
already asking, so good.

*Ethically* you've signed up (CISSP) to "Protect society, the commonwealth,
and the infrastructure".  Depending on what you and staff are seeing, if you
believe a threat exists, you should be reporting it.

If the theme you described is dominant across all of the photos on the
drive, it does seem suspicious.  If they're a small subset of a variety of
other themes, the judgement call may be trickier.

Since you're asking the question, something is triggering an instinct or
reaction.  IME, these are generally correct.

On Mon, Dec 08, 2008 at 12:18:54PM -0700, Bob Henry wrote:
> One of our Housing office computer techs sent me the following
> question and I'd like to know what members of this list think.  Has
> anyone bumped into this and what did you do?  I've forwarded the
> question to legal as well.
> A student brought his computer to the Student Housing computer support
> people for repairs.  The computer wouldn't boot and the student told
> the Housing technicians they could format the drive if they needed to.
>  The technician managed to boot the computer from its existing
> configuration.  On the computer, the technician found many pictures of
> jet airplanes, interior and exterior pictures of Boise skyscrapers,
> pictures of the presidents planes, videos of planes crashing, pictures
> of airports, pictures of the walkways from the airport, a connection
> to American airlines flights.
> What are our responsibilities for handling this information?  Can we
> present it to law enforcement or would we be violating the 4th
> amendment?
> -- 
> Robert Henry, CISSP, GCIH, GCFA
> Information Security Officer
> Office of Information Technology
> Boise State University
> 208-426-5701
> bhenry at boisestate.edu
> http://boisestate.edu/oit/iso
> _______________________________________________
> unisog mailing list
> unisog at lists.dshield.org
> https://lists.sans.org/mailman/listinfo/unisog

More information about the unisog mailing list