Computer Science and
He notes the risks from
Crime
MICHAEL M. LOSAVIO, DEBORAH G.
KEELING, PAVEL PASTUKHOV, and
SVETLANA POLYAKOVA
Issues for Computing, Computational
Forensics, and Data Analytics
Computer science is, reductively, the study of
computers, those automatic devices for acting
on information. In Computing as a Discipline
Denning and his colleagues defined computing
as: “The discipline of computing is the systematic
study of algorithmic processes that describe and
transform information: their theory, analysis,
design, efficiency, implementation, and appli-
cation. The fundamental question underlying
all of computing is, ‘What can be (efficiently)
automated?’” (Denning et al., 1989).
The computing device is only part, albeit an
important part, of the application of computer
science to criminal justice. The fundamental part
is that of the “algorithmic processes,” the auto-
matic application of rules to bits of information to
produce particular outcomes or decisions. From
the early days of the Jacquard looms automati-
cally weaving cloth according to rules encoded
on wooden blocks to automated, voice-activated
search for information on a cellular telephone,
the computational process converts informa-
tion into a form to which rules may be applied,
applies those rules, and produces an outcome.
Often those outcomes themselves are converted
into forms humans can understand.
This focus on algorithmic processes maps
smoothly to aspects of the administration of
justice as the latter has evolved as a set of rule-
based processes for fairness and reliability in
its administration. Srihari (2010) suggests that
computational systems, properly used and under-
stood, can greatly enhance the effectiveness of
standard forensic techniques by efficiently apply-
ing probability analysis and pattern matching
The Encyclopedia of Crime and Punishment, First Edition. Edited by Wesley G. Jennings.
© 2016 John Wiley & Sons, Inc. Published 2016 by John Wiley & Sons, Inc.
DOI: 10.1002/9781118519639.wbecpx101
to enhance reliability.
error-prone methods, highlighted by the finger-
print identification-based FBI arrest of a Seattle
lawyer for the 2004 Madrid, Spain, bombings who
was subsequently exonerated; Spanish authorities
matched the fingerprint to an Algerian with a
criminal record and terrorist ties.
Computational systems may play a role in
the prevention, investigation/adjudication, and
proper punishment for crimes, whether they are
computer crimes or traditional crimes of violence
and theft.
Use of Data Analytics and Computational
Forensic Evidence
Computation may be used in three interwo-
ven areas of criminal justice: investigation,
adjudication, and punishment. Decisions in each
of these areas require data, the collection of that
data, and its analysis. Traditional forensics theory
opines that any event, any interaction, produces
data, if only it can be found. The computational
world brings with it new types of devices for
generating such data and collecting data that
would otherwise be difficult or costly to collect or
would be ephemeral and quickly lost.
Investigation of crime requires the collection of
such data on individual crimes for prosecution
and prevention. That data collection may focus on
data in relation to a particular crime or to aggre-
gate criminal activity. The data may be collected
and analyzed to see what happened in the past
(forensic analysis), what may be happening now,
and what may happen in the future (predictive
analytics). Such a collection process requires the
data be taken into the dominion and control of
authorities for proper use. Ideally this will collect
disparate and diverse data from many sources
that may be examined in new ways.
With this growth in the amount of data gen-
erated, stored, and collected, computation offers
powerful and efficient ways to sift and ana-
lyze all that information to seek out relevant
information from which good decisions may
be made. This process has been known as data
mining, knowledge discovery, and data analytics.
2 COMPUTER SCIENCE
From this, specialized areas of data analysis have
evolved relating to particular disciplines, such
as police analytics and predictive analytics for
corrections.
One global paradigm or such a system of data
collection and analysis is the “Smart City,” its
components, and its citizens. This can be seen as
an environment that is instrumented, intercon-
nected, and intelligent; it involves the capture and
generation of data through instrumented systems,
the collection of that data through interconnected
instruments, and analysis by intelligent analytical
systems. The sources, collections, and analytics
of information begin with the sources of the
data, from people themselves, their work, their
domestic life, their transport, and their social
interactions. Each of these spheres of activity
may collect and transmit data on activities in
different ways.
Computational forensics (CF) addresses
enhanced investigations of typical, traditional
criminal activity (Franke & Srihari, 2007). It
should also be considered in the context of
electronic informational artifacts, both as tools
and targets of crime. CF has the potential for
great benefits and significant risks (Franke &
Srihari, 2007). Those benefits include the deriva-
tion of investigative and forensic conclusions as
to criminal activity. Examples of types of crimes
that may be subject to CF systems for crimi-
nal investigations include possible contraband
exchanges over peer-to-peer networks and crim-
inal copyright violations over networks. One key
risk is the misidentification of legal activities as
criminal, particularly where a particular forensic
technology has not been sufficiently vetted as to
reliability. Another risk is that these technologies
will give government, and others, unprecedented
informational profiles on the lives of average,
innocent civilians that intrude into accepted
notions of personal privacy and autonomy.
These systems and their workings are beyond
everyday experiences. The special scrutiny of
expert systems under FRE 702 in the United
States requires that any conclusions based on spe-
cialized knowledge should show reliability across
three dimensions: the validity of the principles or
theories used, the validity of the technique using
those principles, and the proper use of the tech-
nique against the facts needed to make a reliable
conclusion (Giannelli & Imwinkelried, 2007). In
AND CRIME
evaluating these, a variety of factors may be used,
including validation testing, peer review, error
rate assessment, standards and protocols, and
the nature of the “general acceptance” of forensic
system.
Data, Data Collection, Analytic, and CF
Systems
Advances in computer science systems in
criminal justice use computer engineering,
computer software tools and techniques, and
operational-search activity. All of these begin
with a structure, as with any type of investigation:
the location of evidence, the collection of the evi-
dence, and the analysis of that data. The growth
in ubiquitous computing, the internet of things,
the “Smart City,” and other manifestations of
computational devices permeating all aspects
of life creates vast volumes of data in growing
data collections subject to analysis.
This may be seen in the domain of transporta-
tion systems and the attendant data from the
need of people to go from one place to another
for work, home, and social activities. Of cars
worldwide, 60% should have connected capabil-
ities by 2017 (ABI Research, 2012). Some of the
sources and types of data these systems collect
and store on the local instrumentation include
the Vehicle Event Data Recorders of vehicle status
such as braking, acceleration, and speed, onboard
telecommunications that store telephone and
contact numbers, messages, and texts, and GPS
navigation systems that track trip data, home
site, and travel path. More and more, these data
generation systems are interconnected for such
collection through automotive telematics using
roadside readers, satellite, or local stations. Data
include data for navigation, tracking, Stolen Vehi-
cle Slowdown, Remote Ignition Block location,
speed, braking, and other third-parties services
data such as Client ID, time, and location data.
The data are collected and transmitted via new
technologies and services that are offered by
a variety of companies and government agen-
cies. Examples include the GM OnStar service,
Chevrolet Volt, and Nissan Carwings monitoring
systems, Supplemental OBD/EDR monitors,
insurers Travelers’ IntelliDrive and Progres-
sive’s Snapshot, and pass-by toll and fee road
 COMPUTER SCIENCE
transponders. The next generation of OBD III
transponder-assisted onboard monitoring will
expand the scope of data collected and transmit-
ted. All of this locational data, transactional data,
and communication content permits the creation
of profiles of individuals in ways that previously
would require significant police manpower.
With this growing body of information col-
lected and now available for review comes the
need for systems to do that analysis efficiently.
This type of review is what computational systems
do best, where the information is in a computable
form and there exist algorithms or rule sets that
can sift, parse, find, and infer the meaning of the
data. Some of the earliest use of computational
discovery is a discipline known as information
retrieval (IR). The IR tool examines the data and
returns records that correspond to the IR search
query setting out the requirements of relevance.
Those relevant terms and results may be ini-
tially generated and reviewed by a person, but
increasingly sophisticated statistical tools may
sharpen the accuracy and power of those results.
The forensic role of the computer science dis-
cipline of IR in criminal investigations and trials
was addressed in the prosecution of a federal
employee for accepting money to expedite visa
applications. The defendant had demanded the
government produce electronic evidence relating
to consulate practices and actions regarding
expedited visas and objected that the govern-
ment’s search term/keyword methodology was
inadequate. The District Court observed that
determining the sufficiency of the method was
“a complicated question involving the interplay,
at least, of the sciences of computer technology,
statistics and linguistics” (Paul & Baron, 2007).
There has been a special topic of concern relating
to electronic discovery of evidence. The Working
Group on Electronic Discovery of the Sedona
Conference is studying that subject and their
work indicates how difficult this question is;
the Sedona Conference is a special commit-
tee charged with giving guidance on electronic
discovery to the federal courts.
Evaluation of IR tools and methods considers
the “precision,” “recall,” and “fallout” of analysis.
Those represent the ratio of retrieved relevant
documents to the total of retrieved documents,
the ratio of retrieved relevant documents to the
total of all relevant documents, and the ratio
AND CRIME 3
of retrieved irrelevant documents to the total
of all irrelevant documents. This determination
is essential for validating the IR technique and
its usefulness (Singhal, 2001). For example, to
improve efficiency against growing volumes of
electronic data that must be searched for contra-
band materials like child pornography or techni-
cal trade secrets, digital forensic tools use compu-
tational information retrieval methods to speed
examination. These searches may be for key-
words in metadata relevant to the investigation,
analysis of data relating to computational MD5
hash file signatures for pattern match analysis, or
characteristic matching of image or video files.
The computer’s ability to do statistical analysis
is a powerful tool, but one that is controversial as
applied to issues of criminal justice ranging from
adjudication to punishment. But this type of anal-
ysis has already made its way into judicial pro-
cess. The federal sentencing guidelines themselves
are based on a probabilistic model of sentencing
behavior of the courts of the United States (Breyer,
1988). The US Sentencing Commission continu-
ally examines sentencing data and practices and
the sentencing guidelines are modified to reflect
practice and law and policy changes, reflecting a
statistical model for setting the advisory ranges
of terms of imprisonment that are consistent, cer-
tain, and fair.
Corrections face a variety of needs that ana-
lytics may enhance. The Florida Department
of Corrections uses its Corrections Integrated
Needs Assessment System (CINAS) to identify
and prioritize inmates as to the rehabilitative
programs they need to reduce recidivism and
risks within institutions. CINAS is a predictive
tool using SAS statistical software and its capabil-
ities for regression and survival analysis. Subject
monitoring is a primary function of correctional
systems, from institutional control to parole
and probation monitoring. Surveillance/video
analytics keyed to video sensors can alert staff
to improper activity by inmates while screening
out innocuous activity, expanding surveillance
without more human resources subject to dis-
traction and inattention. Honeywell Corporation
asserts that its video analytics software can pro-
file against 35 behaviors and events in order to
augment human monitoring.
These techniques come together in the opera-
tional search activity in the Russian Federation.
4 COMPUTER SCIENCE
This may be undertaken by public and secret law
enforcement agencies to protect the life, health,
rights, and freedoms of citizens, property, secu-
rity, society, and the state from criminal attacks
(Federal Law N 144-FZ, 1995). Given the nature
of electronic information technologies, the group
of search operations carried out in order to detect
computer crimes and evidence includes:
• monitoring of mail, telegraph, and other com-
munications;
• wiretapping;
• interception of information from technical
communication channels.
Interception of information from technical com-
munication channels relates to computer traffic
over the networks of electricity and postal ser-
vices. An electrical connection is interpreted as
follows: “Any transmission or reception of signs,
signals, writing, images and sounds by wire,
radio, optical or other electromagnetic systems,
telecommunication networks – technological
systems that provide one or more types of trans-
missions: telephone, telegraph, fax, data and other
documentary messages, including the exchange
of information between computers, television,
sound and other forms of radio and cable
broadcasting” (Federal Law N 126-FZ, 2003).
The Russian Federal Law “On operative-search
activity” permits the use of technical means for
monitoring all types of messages sent across
all channels of communication. Large-scale
dissemination of information and telecommu-
nications networks and the huge number of
crimes committed in these networks require
systemic responses to crime in this area. The
Law Enforcement Support System to ensure
the operational-search actions is known by its
Russian acronym “SORM.”
SORM can be defined as a set of technical
means and measures intended to carry out search
operations in telephone networks, mobile and
wireless communications, and radio. SORM as
a combination of hardware and software tools
and techniques captures telephone and mobile
phone communications, intercepts internet traf-
fic, and collects information from all forms of
communication, providing long-term storage of
all information and data on subscribers. SORM
is an automated information system suite for
AND CRIME
special purposes, to be connected to the switch-
ing equipment telecommunication operator and
intended for operational-search activities carried
out in the public telecommunication channels.
Required access delineates both the nature of
the access and types of data to be accessed, which
may then be collected and analyzed. Information
about the location of a control object, depend-
ing on the standard and the availability of such
information, comprises one or more types of data
about the location of an object of verification.
The operators of communication networks must
put in place technical means for operational and
investigative activity, means that access all data
transmitted over the networks. The acquired
information, such as electronic messages, is then
given over to the control of the state agency
having the authority to conduct and order the
search of the data. (Ministry of Communications
of the Russian Federation, 2010)
The SORM system provides for computa-
tional monitoring and analysis of informational
and locational activities across vast volumes of
information and actors.
Conclusion
Computational systems hold great value for the
administration of justice. But, as with any expert
systems, they have risks of promising more than
they can deliver. In one narcotics prosecution a
statistical computer simulation was proffered to
demonstrate the amount of contraband involved,
but the court rejected that evidence. Having
appointed its own experts to analyze the compu-
tational method, the court found the simulation
of 100,000 scenarios did nothing to actually
determine a probability distribution regarding
the defendant’s actions (United States v. Shonubi,
1995).
The court’s specialists noted “the uncritical
acceptance of any statistical method invites us
to be misled. By the same token, the rejection of
all statistical evidence may leave us ill-informed
when we do not have to be.” Data analytics and
computational forensics will continue to grow
in importance for law enforcement and national
security. They guard against any tendency toward
a reduced reliability that may come from care-
lessness or faux scientific methods of evaluation.
 COMPUTER SCIENCE
Another issue with new “scientific” techniques
lies in being beyond common experience and
tradition. Data analytics/computational forensics
create evolving questions as to liberty, autonomy,
and privacy. The sheer power of computational
forensics for data analysis and matching from new
data sources goes beyond improved investiga-
tions; it is a proactive tool to identify perpetrators
in ways not possible before. The power and bene-
fits of computational systems require we examine
and assure their proper use in a democratic
society. As Justice Sonya Sotomayor of the US
Supreme Court said, these systems may “alter
the relationship between citizen and government
in a way that is inimical to democratic society”
(United States v. Jones, 2012).
SEE ALSO: Cyberbullying; Digital Crime; Iden-
tity Theft.
References
ABI Research. (2012). By 2017 60% of new cars
shipping globally will feature connected car solu-
tions,. Retrieved May 15, 2015, from https://www.
abiresearch.com/press/by-2017-60-of-new-cars-
shipping-globally-will-feat
Breyer, S. (1988). The federal sentencing guidelines and
the key compromises upon which they rest. Hofstra
Law Review, 17(1), 19–20.
Denning, P. J., Comer, D. E., Gries, D., Mulder, M. C.,
Tucker, A., Turner, J., & Young, P. R. (1989). Com-
puting as a discipline. Communications of the ACM,
32(1), 9–23.
Federal Law of 12.08.1995 N 144-FZ, Art. 1 (as
amended on 28.06.2013) “On operative-search activ-
ity” / / Collected legislation of the Russian Federa-
tion. 1995, N 33, p. 3349.
Federal Law 07.07.2003 (as amended on 18.07.2011) N
126-FZ. “On communication” / / Collected legisla-
tion of the Russian Federation. 2003, N 28, art. 2895.
Franke, K., & Srihari, S. N. (2007). Computational
forensics: Towards hybrid-intelligent crime investi-
gation. In N. Zhang (Ed.), Third international sym-
posium on information assurance and security (IAS
2007) (pp. 383–386). Los Alamitos, CA: IEEE Com-
puter Society.
Giannelli, P. C., & Imwinkelried, E. J. (2007). Scientific
evidence (4th ed.). Newark, NJ: LexisNexis.
Ministry of Communications of the Russian Federation
(2010). Order of the Ministry of Communications of
the Russian Federation of 27.05.2010 N 73.
AND CRIME 5
Paul, G. L., & Baron, J. R. (2007). Information inflation:
Can the legal system adapt? Richmond Journal of Law
and Technology, 13(3), 1–41.
Singhal, A. (2001). Modern information retrieval:
A brief overview. Retrieved May 15, 2015, from
http://singhal.info/ieee2001.pdf
Srihari, S. (2010). Beyond C.S.I.: The Rise of Com-
putational Forensics Pattern recognition and
other computational methods can reduce the bias
inherent in traditional criminal forensics, IEEE
Spectrum. Retrieved May 15, 2015, from http://
spectrum.ieee.org/computing/software/beyond-csi-
the-rise-of-computational-forensics
United States v. Jones, 132 S. Ct. 945, 565 US ___ (2012).
United States v. Shonubi, 895 F. Supp. 460 (ED New York
1995).
Further Readings
Bunting, S. (2007). EnCase computer forensics: Encase
certified examiner study guide. Hoboken, NJ: John
Wiley & Sons, Inc.
Daubert v. Merrill Dow Pharmaceuticals, Inc., 509 U.S.
579 (1993).
Decree of the President of the Russian Federation of
01.09.1995 N 891 “On the Regulation of organiza-
tion and conduct search operations using technical
means” / / Collected legislation of the Russian Feder-
ation. 1999, N 24, art. 2954.
Fienberg, S. E., & Schervich, M. J. (1986). The relevance
of Bayesian inference for the presentation of evidence
and for legal decision making. Boston University Law
Review, 66, 771–798.
Honeywell. (2013). Intelligent video analytics for the
corrections market, Honeywell overview. Retrieved
October 16, 2013, from https://www.security.honey
well.com/uk2/documents/VideoAnalytics_
Corrections_UK.pdf
Ministry of Communications of the Russian Federation.
(2011). Order of the Ministry of Communications of
the Russian Federation of 11.07.2011 N 174 N 36,
2011.
Nasraoui, O., Keeling, D., Elmaghraby, A., Higgins,
G., & Losavio, M. (2008) Work-in-progress paper:
node-based probing and monitoring to investigate
use of peer-to-peer technologies for distribution
of contraband material. In Proceedings of the 2008
third international workshop on systematic approaches
to digital forensic engineering (pp. 135–140). Los
Alamitos, CA: Institute of Electrical and Electronics
Engineers.
Ripeanu, M., Foster, I., & Iamnitchi, A. (2002). Map-
ping the Gnutella network: Properties of large-scale
peer-to-peer systems and implications for system
6 COMPUTER SCIENCE
design. IEEE Internet Computing – special issue on
peer-to-peer networking, 6(1), 50–57.
SAS. (n.d.). Florida Department of Corrections
turns to SAS® for enterprise reporting and pre-
dictive analytics that improve citizen safety.
SAS data sheet. Retrieved May 15, 2015, from
http://www.sas.com/success/floridadoc.html
Sedona Conference. (2008). The Sedona conference,
best practices commentary on the use of search and
information retrieval. The Sedona Conference Jour-
nal, 8, 189.
AND CRIME
SEMA. (2002). OBD-III frequently asked ques-
tions. Retrieved May 15, 2015, from http://lobby.
la.psu.edu/_107th/093_OBD_Service_Info/
Organizational_Statements/SEMA/SEMA_OBD_
frequent_questions.htm
Wong, J. L., Kirovski, D., & Potkonjak, M. (2004).
Computational forensic techniques for intellec-
tual property protection. IEEE Transactions On
Computer-Aided Design of Integrated Circuits and
Systems, 23(6), 987–994.