Computer Forensics in Fiction

New television show -- CSI: Cyber. I hope they have some good technical advisers, but I doubt they do.

Posted on May 13, 2014 at 12:45 PM • 27 Comments

Comments

ChelloveckMay 13, 2014 12:56 PM

There was a recent CSI episode that acted as an introduction to the new show. The networking is every bit as realistic as the zoom-and-enhance image processing technology CSI is known for.

AnuraMay 13, 2014 12:59 PM

This is from the same show that said "I'll create a GUI interface using Visual Basic, see if I can track an IP address!"

ChristopherMay 13, 2014 1:23 PM

They get the extra pixels for their "Zoom and Enhance" pictures from the same alternate universe that supplies Bruce Banner with the extra mass required to become The Hulk.

Eugene BogoradMay 13, 2014 1:45 PM

What original CSI did was raise the anticipated threshold of proof. It was way about reasonable, but good for defendants. Juries now expect DNA etc, which is unavailable in most cases.

If this show effectively kills malicious "forensic" prosecution of digital "crimes" - well, heil CSI :)

DaveMay 13, 2014 1:53 PM

There are some people who will claim that CSI grew the STEM enrollments at colleges and universities. Maybe a show like this will bring enough realism to drive infosec topics to kitchen table conversations. I see this as a win for our industry. There are few places and careers that they make TV shows about, we're now going to be in that club.

AnuraMay 13, 2014 2:43 PM

RE: IP Addresses... Maybe someone will learn about the TEST-NET IP Ranges:


The blocks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3) are provided for use in documentation.

All of these appear to be valid addresses, without being obvious private IPs.

watcherMay 13, 2014 2:50 PM

@Thoomas

The out of range IP addresses are there so they don't accidentally use any real address exists or might in the future. They do similar to fictitious telephone numbers in the media. Remember the prefix 555.

This is a show I might watch just for the fun factor and the drinking game let us spot the errors.

Nicholas WeaverMay 13, 2014 3:22 PM

It will be bad. Admittedly we hate-watch the original CSI Colon (gotta pronounce : to get the effect), and saw the backdoor pilot. Ridiculously bad.

So bad that although they could probably use a good technical adviser, the backdoor pilot is such it would be hard to get a technical adviser to be willing to have their name in the credits.


However, I have a pseudonym or three that would work, so if they want a technical adviser and they contact you, feel free to forward them to me.

0x4209May 13, 2014 3:54 PM

It's almost impossible for them to do things accurately. It'd be brief descriptions with the 'talent' actor cut out of episodes for long period to simulate the hours, days, weeks, or months it takes to find zero-days in IDA and other RE tools..

RSaundersMay 13, 2014 5:00 PM

@ 0x4209,
That's the problem with all the CSI/L&O shows. Police work takes a long time and most of it is spent waiting for things you can't make faster. "Rush" DNA takes 4-6 weeks and "rush" toxicology 10-14 days. The show has to be over in an hour. That means we have to leave stuff out to save time.

Ever wonder why the Star Trek series invented the "transporter"? Certainly it wasn't because turning a 100kg human into energy was a safe thing to do (e=mC^2). It was because nobody would want to watch walking down to the shuttle bus, getting in, flying to the planet surface, finding a place to part, etc.

While Eugene Bogorad raises some good points on the impact on our legal system, I'm more troubled by the effect on our news system. Something big happens, all networks are streaming the police press conferences in real-time, 24/7. What does the first news conference say "We don't know much yet." and so on for a week or so. In between, the lack of actual news facts does nothing to keep the newsies from spouting any random theory that pops into their head as "well maybe it's X". At least with computers, they don't know enough jargon to say anything. Fill everybody up with out vocabulary, let them hash/randomize the meanings, and we'll need to start all over again to be able to talk to each other.

Do we really want what Person of Interest did for the intelligence community?

Natanael LMay 13, 2014 6:17 PM

@RSaunders: Actually, the Star Trek transporter was introduced because it was too expensive to build a set with shuttles and showing them land. They needed another method of transport that was cheaper to render.

bcsMay 13, 2014 8:03 PM

The CSI et al. drinking metrics:

Step 1: Watch the show. Drink a shot each time someone spots a technical flaw or factual error. Take a sip for anything that's highly dubious or unlikely.

Step 2: Sober up and see how many minutes of the show you can reconstruct from memory.

Step 3: Watch it again and see how many minutes of it you need to get enough clues to solve the mystery.

If step 2 is usually less than step 3 (or 3 is longer than the whole episode): black list the show.

randomjnerdMay 13, 2014 9:00 PM

This from a series that in the same episode showed oil sinking in water, and electrocution with a whopping 12 volts on dry skin.

AnuraMay 14, 2014 12:07 AM

@Nicholas Weaver

So bad that although they could probably use a good technical adviser, the backdoor pilot is such it would be hard to get a technical adviser to be willing to have their name in the credits.

I prefer to think that they do have knowledgeable technical advisers, but that they are jerks.

Clive RobinsonMay 14, 2014 3:56 AM

Hmm, it had Patricia Arquette in the "one off" I hope her performance was better than in the 2000 film Little Nicky [1] for which she was nominated for the Golden Raspberry worst supporting actress...

With regards "Cyber" the original NCIS has always rated high on the "no way no how" factor, requiring a lot of suspension of disbelief to get through half the episodes (@Nick P and I have joked on it on this blog in the past).

That said us "law abiding" non US citizens in the EU who don't want a "You've been a naughty downloader letter" will either have to pay a Kings Ransom to the Murdoch Evil Empire or wait a couple of years to watch it. By which time technology might have surpassed the fiction ;-)

[1] A film that's so excrutiatingly bad it actualy rates as worth watching on TV...

Clive RobinsonMay 14, 2014 4:12 AM

@ uh, Mike

He's using triple-ROT13, so it's going to take me awhile to decrypt.

Are you aware of the latest patch to quintiple-ROT13? Apparantly it's designer Li O'Ekans claims it doubles the security margin of triple-ROT13.

kronosMay 14, 2014 8:09 AM

What is more fun than watching NCIS/CSI type shows and finding the goofs is when you are watching with a group of people and there just happens to be experts within that group from various technical fields. It is especially fun (I am redefining 'fun' here) when you have a cop, a medical person and a computer person. But it can be a learning experience even though it takes most of the enjoyment out of TV shows.

I suspend most of my belief for cop and medical shows. I can't stand lawyer shows for some oddball reason - probably because I have actually spent time in real courtrooms.

John CampbellMay 14, 2014 8:36 AM

So, what's the theme music?

IIRC, listening to some of these CSI series, they were using music from The Who.

I joked, some time ago, that, by the time they got to CSI:Cleveland or CSI:Accounting (Forensic accounting) that they'd be down to using The Who's "Momma's got a squeeze box".

I can imagine, for Cyber, them using some of the music from "Transformers"... though... are they step-up or step-down?

And, now a joke for electrical engineers: Resistance is futile... but impedance can be fun!

Chris SMay 14, 2014 10:50 AM

Re: theme music

CSI: Des Moines --- "I Can See For Miles"

(ok, it's a stereotype)

HoratioMay 14, 2014 9:09 PM

Eric, I think this man has been hashed [puts on glasses, backs out of the shot] YYYYEEEEEAaaaaaaaahhhh!

dot tilde dotMay 15, 2014 2:25 AM

must be xterms _and_ joysticks all the way to the bottom. i drink a shot every time someone pronounces csi without the colon. sugar in the morning!

.~.

Ben CheamMay 28, 2014 5:38 PM

I watched the pilot episode last night and notice they got an Australian actor to play the tech support person. Does the FBI hire Australians?

Leave a comment

Allowed HTML: <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre>

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Resilient Systems, Inc.