Actually, in my CISSP training the point was emphasized that securing
evidence was legally important, but avoiding further harm to victims was also
very important. There are techniques that are used to preserve the evidence
in a chain of custody that is legally valid while also addressing the need
for expeditiously returning the equipment to service.
Consider that if the system can be preserved in the cracked state whilst
awaiting law enforcement response, without immediately being restored to
service, it can probably be left offline long enough for a good image backup
or hard drive swap to be done.
Also, there may be a distinction made in the handling of systems belonging to
victims versus suspects' property. Personally I can't get as sympathetic
about the confiscation of some script-kiddie's toys as I would be about the
tools belonging to a legitimate business.
Finally, I'd expect that the quality of response from various law enforcement
agencies would vary. They're human after all, and thus both fallible and
subjective, but in my fairly extensive experience with them they are mostly
quite professional. If there is reason to expect that they would not handle
a case well, perhaps some pro-active education is in order?
Personally I'd bet the handling by law enforcement personnel would be of
higher quality than the handling by college administrators and others of the
PHB class...
--Bruce McCulley
Willard Flagg wrote:
> On Wed, 4 Oct 2000, Derek Martin wrote:
>
> > likely. The only allowable "retribution" is involving law enforcement,
> > which in all likelihood is worse than the disease...
>
> I was wondering when someone was going to mention the downside of
> contacting law enforcement. If you do convince them to take action it is
> likely that their first step will be to impound all of your equipment.
> Nice guys that they are.
>
> -wf
**********************************************************
To unsubscribe from this list, send mail to
[EMAIL PROTECTED] with the following text in the
*body* (*not* the subject line) of the letter:
unsubscribe gnhlug
**********************************************************
