Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #3 Technology August 27, 2007
Outline <ul><li>Review of Lecture 2 </li></ul><ul><li>Introduction </li></ul><ul><li>Forensics Technology </li></ul><ul><u...
Review of Lecture #2: Fundamentals <ul><li>Applications </li></ul><ul><ul><li>Law enforcement, Human resources, Other </li...
Introduction <ul><li>Digital forensics includes computer forensics and network forensics </li></ul><ul><li>Computer forenc...
Military Forensics <ul><li>CFX-2000: Computer Forencis Experiment 2000 </li></ul><ul><ul><li>Information Directorate (AFRL...
Law Enforcement Forensics <ul><li>Commonly examined systems: Windows NT, Windows 2000, XP and 2003 </li></ul><ul><li>Prese...
Business Forensics <ul><li>Remote monitoring of target computers </li></ul><ul><ul><li>Data Interception by Remote Transmi...
Forensics Techniques <ul><li>Techniques for finding, preserving and preparing evidence </li></ul><ul><li>Finding evidence ...
Finding Hidden Data <ul><li>When files are deleted, usually they can be recovered </li></ul><ul><li>The files are marked a...
Spyware/Adware <ul><li>Spyware is  computer software  that is installed surreptitiously on a  personal computer  to interc...
Encryption <ul><li>Popular Encryption techniques </li></ul><ul><ul><li>Public key/ Private Key </li></ul></ul><ul><li>Owne...
Internet/Web Tracing <ul><li>Where has the email come from </li></ul><ul><ul><li>Check IP address </li></ul></ul><ul><ul><...
Wireless Technology Forensics <ul><li>Forensic Examination of a RIM (BlackBerry) Wireless Device  http://www.rh-law.com/ed...
Wireless Technology Forensics - 2 <ul><li>The Hardware  </li></ul><ul><ul><li>The RIM device is designed around an Intel 3...
Firewall Forensics <ul><li>http://www.linuxsecurity.com/resource_files/firewalls/firewall-seen.html </li></ul><ul><li>Anal...
Biometrics Forensics: Richard Vorder Bruegge <ul><li>http://www.biometrics.org/bc2004/Bios/vorderbruegge_bio_OK.pdf </li><...
Biometrics Forensics: Richard Vorder Bruegge <ul><li>Advances in the field of biometrics offers great potential for the fi...
Conclusion <ul><li>Two types of forensics: Computer forencis and network forensics </li></ul><ul><li>Computer forencis is ...
Next Steps: Lectures #4 and #5 <ul><li>Guest Lecture (Lecture #4, August 29, 2007) </li></ul><ul><ul><li>Data Mining Techn...
Appendix:  Data Mining/Analysis Dr. Bhavani Thuraisingham The University of Texas at Dallas August 27, 2007
Outline of Data Mining <ul><li>What is Data Mining? </li></ul><ul><li>Data warehousing vs data mining </li></ul><ul><li>St...
What is Data Mining? Data Mining Knowledge Mining Knowledge Discovery in Databases Data Archaeology Data Dredging Database...
Example Data Warehouse Oracle DBMS for Incidents Sybase DBMS for Hackers Microsoft DBMS for Profiles Data Warehouse: Data ...
Data Warehouses vs Data Mining <ul><li>Goal:  Improved business efficiency </li></ul><ul><ul><li>Improve marketing (advert...
<ul><li>Large amounts of current and historical data being stored </li></ul><ul><li>As databases grow larger, decision-mak...
What’s going on in data mining? <ul><li>What are the technologies for data mining? </li></ul><ul><ul><li>Database manageme...
Knowledge Directed Data Mining Data Sources Integrate data sources Clean/ modify data sources Mine the data Examine Result...
Integration of Multiple Technologies Machine Learning Database Management Data Warehousing Statistics Data Mining Visualiz...
Data Mining Needs for Counterterrorism:  Non-real-time Data Mining <ul><li>Gather data from multiple sources </li></ul><ul...
Data Mining Needs for Counterterrorism:  Real-time Data Mining <ul><li>Nature of data </li></ul><ul><ul><li>Data arriving ...
Data Mining Needs for Counterterrorism:  Cybersecurity <ul><li>Determine nature of threats and vulnerabilities </li></ul><...
Data Mining Outcomes and Techniques for Counter-terrorism
Web Usage Mining for Counter-terrorism
Current Status, Challenges and Directions <ul><li>Status </li></ul><ul><ul><li>Data Mining is now a technology </li></ul><...
Upcoming SlideShare
Loading in …5
×

Lecture3.ppt

2,243 views

Published on

  • Be the first to comment

  • Be the first to like this

Lecture3.ppt

  1. 1. Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #3 Technology August 27, 2007
  2. 2. Outline <ul><li>Review of Lecture 2 </li></ul><ul><li>Introduction </li></ul><ul><li>Forensics Technology </li></ul><ul><ul><li>Military, Law Enforcement, Business Forensics </li></ul></ul><ul><li>Forensics Techniques </li></ul><ul><ul><li>Finding Hidden Data, Spyware, Encryption, Data Protection, Tracing, Data Mining </li></ul></ul><ul><li>Security Technologies </li></ul><ul><ul><li>Wireless, Firewalls, Biometrics </li></ul></ul><ul><li>Conclusion and Next Steps </li></ul><ul><li>APPENDIX: Data Mining </li></ul>
  3. 3. Review of Lecture #2: Fundamentals <ul><li>Applications </li></ul><ul><ul><li>Law enforcement, Human resources, Other </li></ul></ul><ul><li>Services </li></ul><ul><li>Benefits </li></ul><ul><li>Using the evidence </li></ul><ul><li>Case Histories/Studies </li></ul>
  4. 4. Introduction <ul><li>Digital forensics includes computer forensics and network forensics </li></ul><ul><li>Computer forencis </li></ul><ul><ul><li>gathers evidence from computer media seized at crime scene </li></ul></ul><ul><ul><li>Issues involve imaging storage media, recovering deleted files, searching slack and free space, preserving the collected information for litigation </li></ul></ul><ul><li>Network forencis </li></ul><ul><ul><li>Analysis of computer network intrusion evidence </li></ul></ul>
  5. 5. Military Forensics <ul><li>CFX-2000: Computer Forencis Experiment 2000 </li></ul><ul><ul><li>Information Directorate (AFRL) partnership with NIJ/NLECTC </li></ul></ul><ul><ul><li>Hypothesis: possible to determine the motives, intent, targets, sophistication, identity and location of cyber terrorists by deploying an integrated forensics analysis framework </li></ul></ul><ul><ul><li>Tools included commercial products and research prototypes </li></ul></ul><ul><ul><li>http://www.afrlhorizons.com/Briefs/June01/IF0016.html </li></ul></ul><ul><ul><li>http://rand.org/pubs/monograph_reports/MR1349/MR1349.appb.pdf </li></ul></ul>
  6. 6. Law Enforcement Forensics <ul><li>Commonly examined systems: Windows NT, Windows 2000, XP and 2003 </li></ul><ul><li>Preserving evidence </li></ul><ul><ul><li>Mirror image backups: Safe Back technology from New Technologies Inc. </li></ul></ul><ul><li>Tools to handle </li></ul><ul><ul><li>Trojan Horse programs / File slacks </li></ul></ul><ul><ul><li>Data Hiding Techniques </li></ul></ul><ul><ul><ul><li>AnaDisk analyzes diskettes </li></ul></ul></ul><ul><ul><ul><li>COPYQM duplicates diskettes </li></ul></ul></ul><ul><ul><li>E-Commerce investigation: Net Threat Analyzer </li></ul></ul><ul><ul><li>Text search: TextSearch Plus tool </li></ul></ul><ul><ul><li>Fuzzy logic/data mining tools to identify unknown text </li></ul></ul><ul><ul><ul><li>Intelligent Forensics Filter </li></ul></ul></ul>
  7. 7. Business Forensics <ul><li>Remote monitoring of target computers </li></ul><ul><ul><li>Data Interception by Remote Transmission (DIRT) from Codex Data Systems </li></ul></ul><ul><li>Creating trackable electronic documents </li></ul><ul><li>Theft recovery software for laptops and PCs </li></ul><ul><ul><li>PC Phonehome tool </li></ul></ul><ul><ul><li>RFID technology </li></ul></ul>
  8. 8. Forensics Techniques <ul><li>Techniques for finding, preserving and preparing evidence </li></ul><ul><li>Finding evidence is a complex process as the forensic expert has to determine where the evidence resides </li></ul><ul><ul><li>Evidence may be in files, evidence may be in disks, evidence may be on paper. Need to track all types of evidence </li></ul></ul><ul><li>Preserving evidence includes ensuring that the evidence is not tampered with </li></ul><ul><ul><li>Involves pre-incident planning and training in incident discovery procedures’ If the machine is turned on, leave it on; do not run programs on that particular computer </li></ul></ul><ul><li>Preparing evidence will include data recovery, documentation, etc. </li></ul>
  9. 9. Finding Hidden Data <ul><li>When files are deleted, usually they can be recovered </li></ul><ul><li>The files are marked as deleted, but they are still residing in the disk until they are overwritten </li></ul><ul><li>Files may also be hidden in different parts of the disk </li></ul><ul><li>The challenge is to piece the different part of the file together to recover the original file </li></ul><ul><li>There is research on using statistical methods for file recovery </li></ul><ul><li>http://www.cramsession.com/articles/files/finding-hidden-data---how-9172003-1401.asp </li></ul><ul><li>http://www.devtarget.org/downloads/ca616-seufert-wolfgarten-assignment2.pdf </li></ul>
  10. 10. Spyware/Adware <ul><li>Spyware is computer software that is installed surreptitiously on a personal computer to intercept or take partial control over the user's interaction with the computer, without the user's informed consent . </li></ul><ul><ul><li>http://en.wikipedia.org/wiki/Spyware </li></ul></ul><ul><li>Spyware is mostly advertising supported software (adware) </li></ul><ul><li>Shareware authors place ads from media company and get a piece if the revenue </li></ul><ul><li>PC surveillance tools that allow a user to nominate computer activity </li></ul><ul><ul><li>Keystroke capture, snapshots, email logging, chats etc. </li></ul></ul><ul><li>Privacy concerns with spyware </li></ul>
  11. 11. Encryption <ul><li>Popular Encryption techniques </li></ul><ul><ul><li>Public key/ Private Key </li></ul></ul><ul><li>Owner of the data encrypts with the public key of the receiver; Receiver decrypts with his private key </li></ul><ul><li>In some cases owner may encrypt with his private key for multiple receiver. Receiver will decrypt with the owner’s public key </li></ul><ul><li>Merkle Hash is a popular method to hash documents; one way hash function </li></ul><ul><li>Challenge is to generate unique keys </li></ul><ul><li>Issues: Trusted authority to generate keys and credentials </li></ul>
  12. 12. Internet/Web Tracing <ul><li>Where has the email come from </li></ul><ul><ul><li>Check IP address </li></ul></ul><ul><ul><li>Sender may use fake address by changing fields; sending server may not check this and so the mail is sent </li></ul></ul><ul><li>Tracing web activity </li></ul><ul><li>Who has logged into the system say from a public web site and modified accounts and grades? </li></ul><ul><li>Web/email tracking tools </li></ul><ul><ul><li>http://www.cryer.co.uk/resources/websitetracking.htm </li></ul></ul><ul><ul><li>http://www.visualware.com/resources/tutorials/email.html </li></ul></ul>
  13. 13. Wireless Technology Forensics <ul><li>Forensic Examination of a RIM (BlackBerry) Wireless Device http://www.rh-law.com/ediscovery/Blackberry.pdf </li></ul><ul><ul><li>“ There are two types of RIM devices within each model class. The Exchange Edition is meant for use in a corporate environment while the Internet Edition works with standard POP email accounts. The Exchange Edition employs Triple-DES encryption to send and receive but the Internet Edition communicates in clear text. Neither employs an encrypted files system” </li></ul></ul><ul><li>Relevance of RIM forensics </li></ul><ul><ul><li>“ The RIM device shares the same evidentiary value as any other Personal Digital Assistant (PDA). As the investigator may suspect of most file systems, a delete is by no means a total removal of data on the device. However, the RIM’s always-on, wireless push technology adds a unique dimension to forensic examination. Changing and updating data no longer requires a desktop synchronization. In fact, a RIM device does not need a cradle or desktop connection to be useful. The more time a PDA spends with its owner, the greater the chance is that it will more accurately reflect and tell a story about that person. Thus, the RIM’s currently unsurpassed portability is the examiner’s greatest ally” </li></ul></ul>
  14. 14. Wireless Technology Forensics - 2 <ul><li>The Hardware </li></ul><ul><ul><li>The RIM device is designed around an Intel 32-bit i386 processor, a low power embedded version of the same processor that used to power a desktop PC. Each unit has 512 KB of SRAM and 4 or 5 MB of Flash RAM, depending on the model. The RIM’s SRAM is analogous to the RAM on a desktop and the Flash memory is the “disk space” used to store the Operating System (OS), applications, and the file system. The RIM’s OS is a single executable named PAGER.EXE and the applications are DLL’s. </li></ul></ul><ul><li>Toolbox </li></ul><ul><ul><li>BlackBerry Desktop Software available free at www.blackberry.com ; BlackBerry C++ Software Development Kit v2.1 available free at www.blackberry.com ; • Hex editor; • Text editor; • AA batteries; • Spare BlackBerry Cradles </li></ul></ul><ul><ul><li>The examination PC should meet the minimum requirements for the BlackBerry Software Development Kit (SDK) and have two available external 9-pin RS232 serial ports. Disk space required for evidence gathering is minimal: space equal to the amount of Flash RAM in the RIM units being investigated. </li></ul></ul>
  15. 15. Firewall Forensics <ul><li>http://www.linuxsecurity.com/resource_files/firewalls/firewall-seen.html </li></ul><ul><li>Analyzing firewall logs, especially what port numbers etc. mean?. May use this information to help figure out what hackers are up to. </li></ul><ul><ul><li>What does destination port number ZZZZ mean? </li></ul></ul><ul><ul><li>What does this ICMP info mean? </li></ul></ul><ul><ul><li>What do these IP addresses indicate? </li></ul></ul><ul><ul><li>Stuff doesn't work </li></ul></ul><ul><ul><li>What are some typical signatures of well-known programs? </li></ul></ul><ul><ul><li>What do these other logs mean? </li></ul></ul><ul><ul><li>How do I configure filters? </li></ul></ul><ul><ul><li>Packet Zen </li></ul></ul><ul><ul><li>What's the deal with NetBIOS (UDP port 137)? </li></ul></ul>
  16. 16. Biometrics Forensics: Richard Vorder Bruegge <ul><li>http://www.biometrics.org/bc2004/Bios/vorderbruegge_bio_OK.pdf </li></ul><ul><li>http://www.biometrics.org/bc2004/Presentations/Conference/2%20Tuesday%20September%2021/Tue_Ballroom%20B/1%20DOJ%20Session/Vorderbruegge_Presentation.pdf </li></ul><ul><li>It often happens that people confuse biometrics and forensics. After all, television and movies make it look like automated biometrics databases can be used to identify and convict people all the time. Isn't that what forensics is all about? Unfortunately, this can have an adverse affect on the development of forensic tools which utilize biometric features, because those in position to make funding decisions may not understand the distinction between the two. This presentation will attempt to provide the audience with a better understanding of the relationship between biometrics and forensics from the standpoint of a forensic scientist. </li></ul>
  17. 17. Biometrics Forensics: Richard Vorder Bruegge <ul><li>Advances in the field of biometrics offers great potential for the field of forensics. Biometric databases offer the promise of enabling law enforcement and the intelligence community to rapidly identify questioned individuals if they are present in the queried database. However, obtaining a &quot;hit&quot; in a biometric database is a far cry from an identification in the world of forensic science. The standard of proof to which forensic scientists in the United States are held is &quot;beyond a reasonable doubt&quot;. That &quot;reasonable doubt&quot; criteria, coupled with standards for scientific and technical evidence elucidated in the &quot;Daubert&quot; and &quot;Kumho Tire&quot; cases, require that conclusions offered by forensic scientists be supported at beyond that offered by current biometric systems, particularly in the field of facial recognition. </li></ul><ul><li>http://forensic-evidence.com/site/ID/ID_prime_qd.html Reviewing Court Approves of Fingerprint Admissibility </li></ul>
  18. 18. Conclusion <ul><li>Two types of forensics: Computer forencis and network forensics </li></ul><ul><li>Computer forencis is mainly about file system forencis; network forensics is about detecting intrusions and connecting with hackers/terrorists </li></ul><ul><li>Various techniques are being developed for Military forensics, Law enforcement forencis, Business forensics; not mutually exclusive </li></ul><ul><li>Difference tools for differing systems </li></ul><ul><li>Systems include operating systems, database systems, networks, middleware, wireless systems, firewalls, biometrics </li></ul><ul><li>Biometrics systems may be compromised; however biometrics may be used as evidence </li></ul><ul><li>Data mining/analysis being used for forensics </li></ul><ul><ul><li>http://eprints.qut.edu.au/archive/00002274/01/2274.pdf (Image mining for digital forensics) </li></ul></ul>
  19. 19. Next Steps: Lectures #4 and #5 <ul><li>Guest Lecture (Lecture #4, August 29, 2007) </li></ul><ul><ul><li>Data Mining Techniques for Malicious code detection </li></ul></ul><ul><li>Lecture #5 (September 5, 2007) </li></ul><ul><ul><li>Chapter 3 of the Text book + additional references </li></ul></ul><ul><ul><li>Types of Computer Forensics Systems </li></ul></ul>
  20. 20. Appendix: Data Mining/Analysis Dr. Bhavani Thuraisingham The University of Texas at Dallas August 27, 2007
  21. 21. Outline of Data Mining <ul><li>What is Data Mining? </li></ul><ul><li>Data warehousing vs data mining </li></ul><ul><li>Steps to Data Mining </li></ul><ul><li>Need for Data Mining </li></ul><ul><li>Example Applications </li></ul><ul><li>Technologies for Data Mining </li></ul><ul><li>Why Data Mining Now? </li></ul><ul><li>Preparation for Data Mining </li></ul><ul><li>Data Mining Tasks, Methodology, Techniques </li></ul><ul><li>Commercial Developments </li></ul><ul><li>Status, Challenges , and Directions </li></ul>
  22. 22. What is Data Mining? Data Mining Knowledge Mining Knowledge Discovery in Databases Data Archaeology Data Dredging Database Mining Knowledge Extraction Data Pattern Processing Information Harvesting Siftware The process of discovering meaningful new correlations, patterns, and trends by sifting through large amounts of data, often previously unknown, using pattern recognition technologies and statistical and mathematical techniques (Thuraisingham 1998)
  23. 23. Example Data Warehouse Oracle DBMS for Incidents Sybase DBMS for Hackers Microsoft DBMS for Profiles Data Warehouse: Data correlating Incidents with Hackers Users Query the Warehouse
  24. 24. Data Warehouses vs Data Mining <ul><li>Goal: Improved business efficiency </li></ul><ul><ul><li>Improve marketing (advertise to the most likely buyers) </li></ul></ul><ul><ul><li>Inventory reduction (stock only needed quantities) </li></ul></ul><ul><li>Information source: Historical business data </li></ul><ul><ul><li>Example: Supermarket sales records </li></ul></ul><ul><ul><li>Size ranges from 50k records (research studies) to terabytes (years of data from chains) </li></ul></ul><ul><ul><li>Data is already being warehoused </li></ul></ul><ul><li>Sample question – what products are generally purchased together? </li></ul><ul><li>The answers are in the data, need to MINE the data </li></ul>
  25. 25. <ul><li>Large amounts of current and historical data being stored </li></ul><ul><li>As databases grow larger, decision-making from the data is not possible; need knowledge derived from the stored data </li></ul><ul><li>Data for multiple data sources and multiple domains </li></ul><ul><ul><li>Medical, Financial, Military, etc. </li></ul></ul><ul><li>Need to analyze the data </li></ul><ul><ul><li>Support for planning (historical supply and demand trends) </li></ul></ul><ul><ul><li>Yield management (scanning airline seat reservation data to maximize yield per seat) </li></ul></ul><ul><ul><li>System performance (detect abnormal behavior in a system) </li></ul></ul><ul><ul><li>Mature database analysis (clean up the data sources) </li></ul></ul><ul><ul><li>Intrusion detection, links between suspicious people and events </li></ul></ul>Need for Data Mining
  26. 26. What’s going on in data mining? <ul><li>What are the technologies for data mining? </li></ul><ul><ul><li>Database management, data warehousing, machine learning, statistics, pattern recognition, visualization, parallel processing </li></ul></ul><ul><li>What can data mining do for you? </li></ul><ul><ul><li>Data mining outcomes: Classification, Clustering, Association, Anomaly detection, Prediction, Estimation, . . . </li></ul></ul><ul><li>How do you carry out data mining? </li></ul><ul><ul><li>Data mining techniques: Decision trees, Neural networks, Market-basket analysis, Link analysis, Genetic algorithms, . . . </li></ul></ul><ul><li>What is the current status? </li></ul><ul><ul><li>Many commercial products mine relational databases </li></ul></ul><ul><li>What are some of the challenges? </li></ul><ul><ul><li>Mining unstructured data, extracting useful patterns, web mining, Data mining, national security and privacy </li></ul></ul>
  27. 27. Knowledge Directed Data Mining Data Sources Integrate data sources Clean/ modify data sources Mine the data Examine Results/ Prune results Report final results Expert System Take Actions
  28. 28. Integration of Multiple Technologies Machine Learning Database Management Data Warehousing Statistics Data Mining Visualization Parallel Processing
  29. 29. Data Mining Needs for Counterterrorism: Non-real-time Data Mining <ul><li>Gather data from multiple sources </li></ul><ul><ul><li>Information on terrorist attacks: who, what, where, when, how </li></ul></ul><ul><ul><li>Personal and business data: place of birth, ethnic origin, religion, education, work history, finances, criminal record, relatives, friends and associates, travel history, . . . </li></ul></ul><ul><ul><li>Unstructured data: newspaper articles, video clips, speeches, emails, phone records, . . . </li></ul></ul><ul><li>Integrate the data, build warehouses and federations </li></ul><ul><li>Develop profiles of terrorists, activities/threats </li></ul><ul><li>Mine the data to extract patterns of potential terrorists and predict future activities and targets </li></ul><ul><li>Find the “needle in the haystack” - suspicious needles? </li></ul><ul><li>Data integrity is important </li></ul><ul><li>Techniques have to SCALE </li></ul>
  30. 30. Data Mining Needs for Counterterrorism: Real-time Data Mining <ul><li>Nature of data </li></ul><ul><ul><li>Data arriving from sensors and other devices </li></ul></ul><ul><ul><ul><li>Continuous data streams </li></ul></ul></ul><ul><ul><li>Breaking news, video releases, satellite images </li></ul></ul><ul><ul><li>Some critical data may also reside in caches </li></ul></ul><ul><li>Rapidly sift through the data and discard unwanted data for later use and analysis (non-real-time data mining) </li></ul><ul><li>Data mining techniques need to meet timing constraints </li></ul><ul><li>Quality of service (QoS) tradeoffs among timeliness, precision and accuracy </li></ul><ul><li>Presentation of results, visualization, real-time alerts and triggers </li></ul>
  31. 31. Data Mining Needs for Counterterrorism: Cybersecurity <ul><li>Determine nature of threats and vulnerabilities </li></ul><ul><ul><li>e.g., emails, trojan horses and viruses </li></ul></ul><ul><li>Classify and group the threats </li></ul><ul><li>Profiles of potential cyberterrorist groups and their capabilities </li></ul><ul><li>Data mining for intrusion detection </li></ul><ul><ul><li>Real-time/ near-real-time data mining </li></ul></ul><ul><ul><li>Limit the damage before it spreads </li></ul></ul><ul><li>Data mining for preventing future attacks </li></ul><ul><ul><li>Forensics </li></ul></ul>
  32. 32. Data Mining Outcomes and Techniques for Counter-terrorism
  33. 33. Web Usage Mining for Counter-terrorism
  34. 34. Current Status, Challenges and Directions <ul><li>Status </li></ul><ul><ul><li>Data Mining is now a technology </li></ul></ul><ul><ul><li>Several prototypes and tools exist; Many or almost all of them work on relational databases </li></ul></ul><ul><li>Challenges </li></ul><ul><ul><li>Mining large quantities of data; Dealing with noise and uncertainty, Needle in the haystack </li></ul></ul><ul><li>Directions </li></ul><ul><ul><li>Mining multimedia and text databases, Web mining (structure, usage and content), Data mining, national security and privacy </li></ul></ul>

×