- This topic has 4 replies, 4 voices, and was last updated 21 years, 6 months ago by
.
-
Posts
-
I hope this is posted correctly, if not please let me know and I’ll post in another forum. I am the MIS Director for a smaller city in Minnesota, and have a brief working knowledge of IM. I have been asked by our city attorney to “educate” a judge on IM for a case that is scheduled to begin May 3rd. I am waiting for specifics of what the claims are, but from what I’ve been told the defendant has been accused of making terroristic threats against another individual over IM (not sure which one yet). The defendant says that the accusor somehow logged in twice, once with his login name, and sent the messages to herself. Again, this is just what I was initially told, it may be different.
The judge wants me to explain how IM works (the basic client/server messaging aspect), and I’m sure I’ll be asked if certain “things” are possible, such as multiple logins. Hopefully the city attorney will get me the information I need so I can sound knowledgable and not answer “wow, I don’t know” all the time!
Is it possible for someone to do what I described? I asked the MSN folks and they won’t answer my questions without a court order, so I thought I’d ask the IM community. Thanks!
Mike
Well, depending on the messenger and PC’s used…anything is possible. If these two people know one another it could just be a case of a shared password. If they don’t know each other it could be a case of a shared, public PC and a keylogger. Some messengers are more notorious for having stolen passwords than others. I’m sure you’ll be briefed by the city attorney…if you have some specific questions at that point I think your questions might be better answered. 🙂
Thanks for the quick response! I too had thought about a public PC, or even a “networked” situation at the accusor’s house that would allow her to log on both PC’s with different ID’s. Again, you’re right, either way she’d have to know his password. I’ve been trying to think of a way that she could do it on a SINGLE pc, as two different users. I suppose one of those virtual machines like Virtual PC or VMware would allow it? Any thoughts on that?
Thanks again!
The specific architecture varies for each instant messaging network, but the basic concept is this:
- Users authenticate by signing in. Most IM networks allow sign-in from only one location, however there are exceptions. The AIM network, for example, allows you to connect from multiple locations concurrently with the same login details.
- A server manages online status and acts as a proxy to establish communication. Your IM contact list checks the online available of other users via the IM network’s server.
- Communication occurs point-to-point. Once a chat session has begun, the communication generally runs from point-to-point (not through a server). There are a few exceptions to this, most notably Jabber, where all messages are routed first to the server and then delivered to the other user.
It is very easy to sign-on to muliple accounts from a single computer. AIM even encourages this practice through what they call “screen name linking” by which you can sign-on once with multiple screen names. The implied purpose is to support different identities and manage your contacts (one identity for work, one for friends, another for family, etc.), although this could be used deceptively.
It is difficult to establish identity on most public networks because the rules for establishing a new screen name are very simple. In most cases you do not need to use your real name and in some cases you don’t even need a valid email address.
On private IM networks such as IBM Lotus Sametime, authentication is managed on a local network and tied to enterprise directory services. These systems provide the ability to link an online identify to a specific person.
With both public and private IM networks, if someone knows or uncovers the password of another person, they can easily sign-on as that person.
I’m curious to know why the defendant is suspected. Were the threats made via a public or private IM network? If it was on a private IM network, there could very well be server logs that could document the conversations and the IP addresses of the computers used in the conversations.
One final note. Most instant messaging programs offer some form of chat logging, but I wouldn’t consider this hard evidence. They are usually stored as ASCII text or XML, and could easily be edited or even fabricated.
- You must be logged in to reply to this topic.