Your watch knows what you did last summer

Body

A smartwatch sitting quietly on someone's wrist may seem unremarkable. But in a criminal investigation, that device could become a witness.

Umit Karabiyik. Photo provided

George Mason University Cyber Security Engineering Associate Professor Umit Karabiyik helps law enforcement agencies across the country understand how data from everyday connected devices can provide critical evidence in criminal cases. Through a U.S. Department of Justice (DOJ)-funded project, Karabiyik and researchers trained thousands of criminal justice professionals and provided technical assistance on cases involving everything from smartwatches and fitness trackers to smart home devices and medical technologies.

"We try to understand this Internet of Things (IoT) ecosystem and extract data from these technologies for evidentiary purposes in courts, criminal investigations, and criminal litigation," said Karabiyik.

The project, funded by the Bureau of Justice Assistance, was first awarded in 2021 while Karabiyik was at Purdue University. Originally planned as a short-term effort, the grant was extended multiple times, allowing the team to continue responding to a growing challenge: helping investigators keep pace with the expansion of connected technologies in everyday life.

IoT devices include smartwatches, fitness trackers, smart appliances, home security systems, smart glasses, medical monitoring devices, and countless other products that collect and exchange data. "Law enforcement agencies need to understand what these technologies are, what the security issues are, what the privacy issues are, and most importantly, how to investigate them," Karabiyik said.

Geolocation data points generated by an iPhone alongside data from nearby WiFi access points. Despite iPhone location services being disabled, information from surrounding devices is still collected. Image provided.

That work often goes beyond research papers and conference presentations. Since the project began, Karabiyik's team has trained more than 7,000 criminal justice professionals through conferences, webinars, and specialized workshops. They have also become a resource for investigators facing technical questions in active cases.

"We get phone calls from law enforcement agencies that say, 'I've got this case, and I got stuck. What do I do?'" Karabiyik said.

One line of research focused on how devices within Apple's ecosystem communicate with one another. Karabiyik's team discovered that Apple devices can collect identifying information about nearby Apple products even without direct interaction from users. The findings created new possibilities for investigators attempting to establish whether individuals or devices had been in proximity to one another.

After presenting the research, Karabiyik received inquiries from investigators working homicide and cold cases who wanted to know whether data from nearby Apple devices could help narrow the list of potential suspects. "These kinds of calls keep coming," he said.

As part of the project, Karabiyik and colleagues serve as a criminal IoT helpdesk, of sorts.

In one case, Karabiyik served as an expert witness in a murder trial where investigators examined data from a smartwatch worn by the defendant, who maintained she had been asleep during the time prosecutors alleged the crime occurred.

"We looked at the technology and proved that she was indeed sleeping," Karabiyik said. "There were no steps taken, and her stress level was perfectly fine until she found the victim dead." The defendant was ultimately found not guilty.

While much of the project focuses on digital forensics, Karabiyik's research also examines the privacy and security risks associated with connected devices. His team has built databases of vulnerabilities and studied how data collected by consumer technologies is stored, shared, and potentially exposed.

He noted that his research influences his own personal use. "I'm very picky about what technologies I use," he said. He avoids devices with microphones and cameras whenever possible, does not use voice assistants such as Alexa or Google Home, and is cautious about products that collect large amounts of personal data.

At the same time, he sees enormous value in connected technologies when they are used responsibly. "Unless you are a bad person, these technologies can be super helpful," he said. "If something happens to me, I know these devices are going to tell law enforcement a lot of things."

As connected devices continue to multiply, Karabiyik expects demand for digital forensic expertise to grow as well. The current project concludes later this year, but he is already pursuing new DOJ funding opportunities aimed at helping forensic examiners, law enforcement agencies, and criminal justice professionals navigate an increasingly connected world.