[unisog] Suspicious Files

Theresa Semmens theresa.semmens at ndsu.edu
Wed Dec 10 15:50:49 GMT 2008

FWIW: This would be considered inadvertent discovery.  As an InfraGard
member, I would not hesitate to contact the general counsel campus police
and let them decide if it should be investigated. Yes, the student may be
just "collecting" the stuff, but that isn't for me to decide. :-) 

Theresa Semmens, CISA
NDSU IT Security Officer
PO Box 6050
North Dakota State University
Fargo, ND 58108
Phone: 701-231-5870
FAX: 701-231-8541
Theresa.Semmens at ndsu.edu

"Opportunity is missed by most people because it is dressed in overalls and
looks like work."  Thomas Edison 

-----Original Message-----
From: unisog-bounces at lists.dshield.org
[mailto:unisog-bounces at lists.dshield.org] On Behalf Of Joshua Krage
Sent: Tuesday, December 09, 2008 12:33 AM
To: unisog at lists.dshield.org
Subject: Re: [unisog] Suspicious Files

4th Amendment most likely doesn't apply as the student voluntarily turned
over the computer and asked for assistance.  Law Enforcement can usually
accept anything under the Best Evidence guideline.

Given the variety of Education-related issues such as internal policy and
previously-set expecations via formal communications, legal issues at local
and state levels, your best *legal* guide will be your legal office.  You're
already asking, so good.

*Ethically* you've signed up (CISSP) to "Protect society, the commonwealth,
and the infrastructure".  Depending on what you and staff are seeing, if you
believe a threat exists, you should be reporting it.

If the theme you described is dominant across all of the photos on the
drive, it does seem suspicious.  If they're a small subset of a variety of
other themes, the judgement call may be trickier.

Since you're asking the question, something is triggering an instinct or
reaction.  IME, these are generally correct.

On Mon, Dec 08, 2008 at 12:18:54PM -0700, Bob Henry wrote:
> One of our Housing office computer techs sent me the following
> question and I'd like to know what members of this list think.  Has
> anyone bumped into this and what did you do?  I've forwarded the
> question to legal as well.
> A student brought his computer to the Student Housing computer support
> people for repairs.  The computer wouldn't boot and the student told
> the Housing technicians they could format the drive if they needed to.
>  The technician managed to boot the computer from its existing
> configuration.  On the computer, the technician found many pictures of
> jet airplanes, interior and exterior pictures of Boise skyscrapers,
> pictures of the presidents planes, videos of planes crashing, pictures
> of airports, pictures of the walkways from the airport, a connection
> to American airlines flights.
> What are our responsibilities for handling this information?  Can we
> present it to law enforcement or would we be violating the 4th
> amendment?
> -- 
> Robert Henry, CISSP, GCIH, GCFA
> Information Security Officer
> Office of Information Technology
> Boise State University
> 208-426-5701
> bhenry at boisestate.edu
> http://boisestate.edu/oit/iso
> _______________________________________________
> unisog mailing list
> unisog at lists.dshield.org
> https://lists.sans.org/mailman/listinfo/unisog
unisog mailing list
unisog at lists.dshield.org

More information about the unisog mailing list