Dynamic analysis of on-board mass data to determine tampering in heavy vehicle on-board mass systems

Transport Certification Australia Limited, jointly with the National Transport Commission, has undertaken a project to investigate the feasibility of on-board mass monitoring (OBM) devices for regulatory purposes. OBM increases jurisdictional confidence in operational heavy vehicle compliance. This paper covers technical issues regarding potential use of dynamic data from OBM systems to indicate that tampering has occurred. Tamper-evidence and accuracy of current OBM systems needed to be determined before any regulatory schemes were put in place for its use. Tests performed to determine potential for, and ease of, tampering. An algorithm was developed to detect tamper events. Its results are detailed.

Adolescent pedometer protocols : examining reactivity, tampering and participants' perceptions

The aim of this study was to investigate adolescents' potential reactivity and tampering while wearing pedometers by comparing different monitoring protocols to accelerometer output. The sample included adolescents (N=123, age range=14-15 years) from three secondary schools in New South Wales, Australia. Schools were randomised to one of the three pedometer monitoring protocols: (i) daily sealed (DS) pedometer group, (ii) unsealed (US) pedometer group or (iii) weekly sealed (WS) pedometer group. Participants wore pedometers (Yamax Digi-Walker CW700, Yamax Corporation, Kumamoto City, Japan) and accelerometers (Actigraph GT3X+, Pensacola, USA) simultaneously for seven days. Repeated measures analysis of variance was used to examine potential reactivity. Bivariate correlations between step counts and accelerometer output were calculated to explore potential tampering. The correlation between accelerometer output and pedometer steps/day was strongest among participants in the WS group (r=0.82, P <= 0.001), compared to the US (r=0.63, P <= 0.001) and DS (r=0.16, P=0.324) groups. The DS (P <= 0.001) and US (P=0.003), but not the WS (P=0.891), groups showed evidence of reactivity. The results suggest that reactivity and tampering does occur in adolescents and contrary to existing research, pedometer monitoring protocols may influence participant behaviour.

On resampling detection and its application to detect image tampering

Usually digital image forgeries are created by copy-pasting a portion of an image onto some other image. While doing so, it is often necessary to resize the pasted portion of the image to suit the sampling grid of the host image. The resampling operation changes certain characteristics of the pasted portion, which when detected serves as a clue of tampering. In this paper, we present deterministic techniques to detect resampling, and localize the portion of the image that has been tampered with. Two of the techniques are in pixel domain and two others in frequency domain. We study the efficacy of our techniques against JPEG compression and subsequent resampling of the entire tampered image.

Food tampering : FDA's actions on Chilean fruit based on sound evidence : report to the ranking minority member, Committee on Foreign Relation, U.S. Senate.

Cover title.

Odometer tampering violations analysis: manual for administration of state odometer enforcement programs. Final report.

National Highway Traffic Safety Administration, Washington, D.C.

Hypnotically refreshed testimony : enhanced memory or tampering with evidence? /

Mode of access: Internet.

Hash-Tree Anti-Tampering Schemes

Procedures that provide detection, location and correction of tampering in documents are known as anti-tampering schemes. In this paper we describe how to construct an anti-tampering scheme using a pre-computed tree of hashes. The main problems of constructing such a scheme are its computational feasibility and its candidate reduction process. We show how to solve both problems by the use of secondary hashing over a tree structure. Finally, we give brief comments on our ongoing work in this area.

Towards trusted wireless sensor networks

This article presents the design and implementation of a trusted sensor node that provides Internet-grade security at low system cost. We describe trustedFleck, which uses a commodity Trusted Platform Module (TPM) chip to extend the capabilities of a standard wireless sensor node to provide security services such as message integrity, confidentiality, authenticity, and system integrity based on RSA public-key and XTEA-based symmetric-key cryptography. In addition trustedFleck provides secure storage of private keys and provides platform configuration registers (PCRs) to store system configurations and detect code tampering. We analyze system performance using metrics that are important for WSN applications such as computation time, memory size, energy consumption and cost. Our results show that trustedFleck significantly outperforms previous approaches (e.g., TinyECC) in terms of these metrics while providing stronger security levels. Finally, we describe a number of examples, built on trustedFleck, of symmetric key management, secure RPC, secure software update, and remote attestation.

Dealing with temporal inconsistency in automated computer forensic profiling

Computer profiling is the automated forensic examination of a computer system in order to provide a human investigator with a characterisation of the activities that have taken place on that system. As part of this process, the logical components of the computer system – components such as users, files and applications - are enumerated and the relationships between them discovered and reported. This information is enriched with traces of historical activity drawn from system logs and from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work examines the impact of temporal inconsistency in such information and discusses two types of temporal inconsistency that may arise – inconsistency arising out of the normal errant behaviour of a computer system, and inconsistency arising out of deliberate tampering by a suspect – and techniques for dealing with inconsistencies of the latter kind. We examine the impact of deliberate tampering through experiments conducted with prototype computer profiling software. Based on the results of these experiments, we discuss techniques which can be employed in computer profiling to deal with such temporal inconsistencies.

Examining psychosocial influences on speeding in Australian and Chinese contexts : a social learning approach

Speeding remains a significant contributing factor to road trauma internationally, despite increasingly sophisticated speed management strategies being adopted around the world. Increases in travel speed are associated with increases in crash risk and crash severity. As speed choice is a voluntary behaviour, driver perceptions are important to our understanding of speeding and, importantly, to designing effective behavioural countermeasures. The four studies conducted in this program of research represent a comprehensive approach to examining psychosocial influences on driving speeds in two countries that are at very different levels of road safety development: Australia and China. Akers’ social learning theory (SLT) was selected as the theoretical framework underpinning this research and guided the development of key research hypotheses. This theory was chosen because of its ability to encompass psychological, sociological, and criminological perspectives in understanding behaviour, each of which has relevance to speeding. A mixed-method design was used to explore the personal, social, and legal influences on speeding among car drivers in Queensland (Australia) and Beijing (China). Study 1 was a qualitative exploration, via focus group interviews, of speeding among 67 car drivers recruited from south east Queensland. Participants were assigned to groups based on their age and gender, and additionally, according to whether they self-identified as speeding excessively or rarely. This study aimed to elicit information about how drivers conceptualise speeding as well as the social and legal influences on driving speeds. The findings revealed a wide variety of reasons and circumstances that appear to be used as personal justifications for exceeding speed limits. Driver perceptions of speeding as personally and socially acceptable, as well as safe and necessary were common. Perceptions of an absence of danger associated with faster driving speeds were evident, particularly with respect to driving alone. An important distinction between the speed-based groups related to the attention given to the driving task. Rare speeders expressed strong beliefs about the need to be mindful of safety (self and others) while excessive speeders referred to the driving task as automatic, an absent-minded endeavour, and to speeding as a necessity in order to remain alert and reduce boredom. For many drivers in this study, compliance with speed limits was expressed as discretionary rather than mandatory. Social factors, such as peer and parental influence were widely discussed in Study 1 and perceptions of widespread community acceptance of speeding were noted. In some instances, the perception that ‘everybody speeds’ appeared to act as one rationale for the need to raise speed limits. Self-presentation, or wanting to project a positive image of self was noted, particularly with respect to concealing speeding infringements from others to protect one’s image as a trustworthy and safe driver. The influence of legal factors was also evident. Legal sanctions do not appear to influence all drivers to the same extent. For instance, fear of apprehension appeared to play a role in reducing speeding for many, although previous experiences of detection and legal sanctions seemed to have had limited influence on reducing speeding among some drivers. Disregard for sanctions (e.g., driving while suspended), fraudulent demerit point use, and other strategies to avoid detection and punishment were widely and openly discussed. In Study 2, 833 drivers were recruited from roadside service stations in metropolitan and regional locations in Queensland. A quantitative research strategy assessed the relative contribution of personal, social, and legal factors to recent and future self-reported speeding (i.e., frequency of speeding and intentions to speed in the future). Multivariate analyses examining a range of factors drawn from SLT revealed that factors including self-identity (i.e., identifying as someone who speeds), favourable definitions (attitudes) towards speeding, personal experiences of avoiding detection and punishment for speeding, and perceptions of family and friends as accepting of speeding were all significantly associated with greater self-reported speeding. Study 3 was an exploratory, qualitative investigation of psychosocial factors associated with speeding among 35 Chinese drivers who were recruited from the membership of a motoring organisation and a university in Beijing. Six focus groups were conducted to explore similar issues to those examined in Study 1. The findings of Study 3 revealed many similarities with respect to the themes that arose in Australia. For example, there were similarities regarding personal justifications for speeding, such as the perception that posted limits are unreasonably low, the belief that individual drivers are able to determine safe travel speeds according to personal comfort with driving fast, and the belief that drivers possess adequate skills to control a vehicle at high speed. Strategies to avoid detection and punishment were also noted, though they appeared more widespread in China and also appeared, in some cases, to involve the use of a third party, a topic that was not reported by Australian drivers. Additionally, higher perceived enforcement tolerance thresholds were discussed by Chinese participants. Overall, the findings indicated perceptions of a high degree of community acceptance of speeding and a perceived lack of risk associated with speeds that were well above posted speed limits. Study 4 extended the exploratory research phase in China with a quantitative investigation involving 299 car drivers recruited from car washes in Beijing. Results revealed a relatively inexperienced sample with less than 5 years driving experience, on average. One third of participants perceived that the certainty of penalties when apprehended was low and a similar proportion of Chinese participants reported having previously avoided legal penalties when apprehended for speeding. Approximately half of the sample reported that legal penalties for speeding were ‘minimally to not at all’ severe. Multivariate analyses revealed that past experiences of avoiding detection and punishment for speeding, as well as favourable attitudes towards speeding, and perceptions of strong community acceptance of speeding were most strongly associated with greater self-reported speeding in the Chinese sample. Overall, the results of this research make several important theoretical contributions to the road safety literature. Akers’ social learning theory was found to be robust across cultural contexts with respect to speeding; similar amounts of variance were explained in self-reported speeding in the quantitative studies conducted in Australia and China. Historically, SLT was devised as a theory of deviance and posits that deviance and conformity are learned in the same way, with the balance of influence stemming from the ways in which behaviour is rewarded and punished (Akers, 1998). This perspective suggests that those who speed and those who do not are influenced by the same mechanisms. The inclusion of drivers from both ends of the ‘speeding spectrum’ in Study 1 provided an opportunity to examine the wider utility of SLT across the full range of the behaviour. One may question the use of a theory of deviance to investigate speeding, a behaviour that could, arguably, be described as socially acceptable and prevalent. However, SLT seemed particularly relevant to investigating speeding because of its inclusion of association, imitation, and reinforcement variables which reflect the breadth of factors already found to be potentially influential on driving speeds. In addition, driving is a learned behaviour requiring observation, guidance, and practice. Thus, the reinforcement and imitation concepts are particularly relevant to this behaviour. Finally, current speed management practices are largely enforcement-based and rely on the principles of behavioural reinforcement captured within the reinforcement component of SLT. Thus, the application of SLT to a behaviour such as speeding offers promise in advancing our understanding of the factors that influence speeding, as well as extending our knowledge of the application of SLT. Moreover, SLT could act as a valuable theoretical framework with which to examine other illegal driving behaviours that may not necessarily be seen as deviant by the community (e.g., mobile phone use while driving). This research also made unique contributions to advancing our understanding of the key components and the overall structure of Akers’ social learning theory. The broader SLT literature is lacking in terms of a thorough structural understanding of the component parts of the theory. For instance, debate exists regarding the relevance of, and necessity for including broader social influences in the model as captured by differential association. In the current research, two alternative SLT models were specified and tested in order to better understand the nature and extent of the influence of differential association on behaviour. Importantly, the results indicated that differential association was able to make a unique contribution to explaining self-reported speeding, thereby negating the call to exclude it from the model. The results also demonstrated that imitation was a discrete theoretical concept that should also be retained in the model. The results suggest a need to further explore and specify mechanisms of social influence in the SLT model. In addition, a novel approach was used to operationalise SLT variables by including concepts drawn from contemporary social psychological and deterrence-based research to enhance and extend the way that SLT variables have traditionally been examined. Differential reinforcement was conceptualised according to behavioural reinforcement principles (i.e., positive and negative reinforcement and punishment) and incorporated concepts of affective beliefs, anticipated regret, and deterrence-related concepts. Although implicit in descriptions of SLT, little research has, to date, made use of the broad range of reinforcement principles to understand the factors that encourage or inhibit behaviour. This approach has particular significance to road user behaviours in general because of the deterrence-based nature of many road safety countermeasures. The concept of self-identity was also included in the model and was found to be consistent with the definitions component of SLT. A final theoretical contribution was the specification and testing of a full measurement model prior to model testing using structural equation modelling. This process is recommended in order to reduce measurement error by providing an examination of the psychometric properties of the data prior to full model testing. Despite calls for such work for a number of decades, the current work appears to be the only example of a full measurement model of SLT. There were also a number of important practical implications that emerged from this program of research. Firstly, perceptions regarding speed enforcement tolerance thresholds were highlighted as a salient influence on driving speeds in both countries. The issue of enforcement tolerance levels generated considerable discussion among drivers in both countries, with Australian drivers reporting lower perceived tolerance levels than Chinese drivers. It was clear that many drivers used the concept of an enforcement tolerance in determining their driving speed, primarily with the desire to drive faster than the posted speed limit, yet remaining within a speed range that would preclude apprehension by police. The quantitative results from Studies 2 and 4 added support to these qualitative findings. Together, the findings supported previous research and suggested that a travel speed may not be seen as illegal until that speed reaches a level over the prescribed enforcement tolerance threshold. In other words, the enforcement tolerance appears to act as a ‘de facto’ speed limit, replacing the posted limit in the minds of some drivers. The findings from the two studies conducted in China (Studies 2 and 4) further highlighted the link between perceived enforcement tolerances and a ‘de facto’ speed limit. Drivers openly discussed driving at speeds that were well above posted speed limits and some participants noted their preference for driving at speeds close to ‘50% above’ the posted limit. This preference appeared to be shaped by the perception that the same penalty would be imposed if apprehended, irrespective of what speed they travelling (at least up to 50% above the limit). Further research is required to determine whether the perceptions of Chinese drivers are mainly influenced by the Law of the People’s Republic of China or by operational practices. Together, the findings from both studies in China indicate that there may be scope to refine enforcement tolerance levels, as has happened in other jurisdictions internationally over time, in order to reduce speeding. Any attempts to do so would likely be assisted by the provision of information about the legitimacy and purpose of speed limits as well as risk factors associated with speeding because these issues were raised by Chinese participants in the qualitative research phase. Another important practical implication of this research for speed management in China is the way in which penalties are determined. Chinese drivers described perceptions of unfairness and a lack of transparency in the enforcement system because they were unsure of the penalty that they would receive if apprehended. Steps to enhance the perceived certainty and consistency of the system to promote a more equitable approach to detection and punishment would appear to be welcomed by the general driving public and would be more consistent with the intended theoretical (deterrence) basis that underpins the current speed enforcement approach. The use of mandatory, fixed penalties may assist in this regard. In many countries, speeding attracts penalties that are dependent on the severity of the offence. In China, there may be safety benefits gained from the introduction of a similar graduated scale of speeding penalties and fixed penalties might also help to address the issue of uncertainty about penalties and related perceptions of unfairness. Such advancements would be in keeping with the principles of best practice for speed management as identified by the World Health Organisation. Another practical implication relating to legal penalties, and applicable to both cultural contexts, relates to the issues of detection and punishment avoidance. These two concepts appeared to strongly influence speeding in the current samples. In Australia, detection avoidance strategies reported by participants generally involved activities that are not illegal (e.g., site learning and remaining watchful for police vehicles). The results from China were similar, although a greater range of strategies were reported. The most common strategy reported in both countries for avoiding detection when speeding was site learning, or familiarisation with speed camera locations. However, a range of illegal practices were also described by Chinese drivers (e.g., tampering with or removing vehicle registration plates so as to render the vehicle unidentifiable on camera and use of in-vehicle radar detectors). With regard to avoiding punishment when apprehended, a range of strategies were reported by drivers from both countries, although a greater range of strategies were reported by Chinese drivers. As the results of the current research indicated that detection avoidance was strongly associated with greater self-reported speeding in both samples, efforts to reduce avoidance opportunities are strongly recommended. The practice of randomly scheduling speed camera locations, as is current practice in Queensland, offers one way to minimise site learning. The findings of this research indicated that this practice should continue. However, they also indicated that additional strategies are needed to reduce opportunities to evade detection. The use of point-to-point speed detection (also known as sectio

Tamper evidence for heavy vehicle on board mass systems

On-board mass (OBM) monitoring devices on heavy vehicles (HVs) have been tested in a national programme jointly by Transport Certification Australia Limited and the National Transport Commission. The tests were for, amongst other parameters, accuracy and tamper-evidence. The latter by deliberately tampering with the signals from OBM primary transducers during the tests. The OBM feasibility team is analysing dynamic data recorded at the primary transducers of OBM systems to determine if it can be used to detect tamper events. Tamper-evidence of current OBM systems needs to be determined if jurisdictions are to have confidence in specifying OBM for HVs as part of regulatory schemes. An algorithm has been developed to detect tamper events. The results of its application are detailed here.

On-board mass monitoring of heavy vehicles : results of testing program

The Transport Certification Australia on-board mass feasibility project is testing various on-board mass devices in a range of heavy vehicles (HVs). Extensive field tests of on-board mass measurement systems for HVs have been conducted during 2008. These tests were of accuracy, robustness and tamper-evidence of heavy vehicle on-board mass telematics. All the systems tested showed accuracies within approximately +/- 500 kg of gross combination mass or approximately +/- 2% of the attendant weighbridge reading. Analysis of the dynamic data also showed encouraging results and has raised the possibility of use of such dynamic information in tamper evidence in two areas. This analysis was to determine if the use of averaged dynamic data could identify potential tampering or incorrect operating procedures as well as the possibility of dynamic measurements flagging a tamper event by the use of metrics including a tampering index (TIX). Technical and business options to detect tamper events will now be developed during implementation of regulatory OBM system application to Australian heavy vehicles (HVs).

Crisis communication under transformative change : the emergent context and roles of primary and secondary organisations

In an era of complex challenges that draw sustained media attention and entangle multiple organisational actors, this thesis addresses the gap between current trends in society and business, and existing scholarship in public relations and crisis communication. By responding to calls from crisis communication researchers to develop theory (Coombs, 2006a), to examine the interdependencies of crises (Seeger, Sellnow, & Ulmer, 1998), and to consider variation in crisis response (Seeger, 2002), this thesis contributes to theory development in crisis communication and public relations. Through transformative change, this thesis extends existing scholarship built on a preservation or conservation logic where public relations is used to maintain stability by incrementally responding to changes in an organisation‘s environment (Cutlip, Center, & Broom, 2006; Everett, 2001; Grunig, 2000; Spicer, 1997). Based on the opportunity to contribute to ongoing theoretical development in the literature, the overall research problem guiding this thesis asks: How does transformative change during crisis influence corporate actors’ communication? This thesis adopts punctuated equilibrium theory, which describes change as alternating between long periods of stability and short periods of revolutionary or transformative change (Gersick, 1991; Romanelli & Tushman, 1994; Siggelkow, 2002; Tushman, Newman, & Romanelli, 1986; Tushman & Romanelli, 1985). As a theory for change, punctuated equilibrium provides an opportunity to examine public relations and transformative change, building on scholarship that is based primarily on incremental change. Further, existing scholarship in public relations and crisis communication focuses on the actions of single organisations in situational or short-term crisis events. Punctuated equilibrium theory enables the study of multiple crises and multiple organisational responses during transformative change. In doing so, punctuated equilibrium theory provides a framework to explain both the context for transformative change and actions or strategies enacted by organisations during transformative change (Tushman, Newman, & Romanelli, 1986; Tushman & Romanelli, 1985; Tushman, Virany, & Romanelli, 1986). The connections between context and action inform the research questions that guide this thesis: RQ1: What symbolic and substantive strategies persist and change as crises develop from situational events to transformative and multiple linked events? RQ2: What features of the crisis context influence changes in symbolic and substantive strategies? To shed light on these research questions, the thesis adopts a qualitative approach guided by process theory and methods to explicate the events, sequences and activities that were essential to change (Pettigrew, 1992; Van de Ven, 1992). Specifically, the thesis draws on an alternative template strategy (Langley, 1999) that provides several alternative interpretations of the same events (Allison, 1971; Allison & Zelikow, 1999). Following Allison (1971) and Allison and Zelikow (1999), this thesis uses three alternative templates of crisis or strategic response typologies to construct three narratives using media articles and organisational documents. The narratives are compared to identify and draw out different patterns of crisis communication strategies that operate within different crisis contexts. The thesis is based on the crisis events that affected three organisations within the pharmaceutical industry for four years. The primary organisation is Merck, as its product recall crisis triggered transformative change affecting, in different ways, the secondary organisations of Pfizer and Novartis. Three narratives are presented based on the crisis or strategic response typologies of Coombs (2006b), Allen and Caillouet (1994), and Oliver (1991). The findings of this thesis reveal different stories about crisis communication under transformative change. By zooming in to a micro perspective (Nicolini, 2009) to focus on the crisis communication and actions of a single organisation and zooming out to a macro perspective (Nicolini, 2009) to consider multiple organisations, new insights about crisis communication, change and the relationships among multiple organisations are revealed at context and action levels. At the context level, each subsequent narrative demonstrates greater connections among multiple corporate actors. By zooming out from Coombs‘ (2006b) focus on single organisations to consider Allen and Caillouet‘s (1994) integration of the web of corporate actors, the thesis demonstrates how corporate actors add accountability pressures to the primary organisation. Next, by zooming further out to the macro perspective by considering Oliver‘s (1991) strategic responses to institutional processes, the thesis reveals a greater range of corporate actors that are caught up in the process of transformative change and accounts for their varying levels of agency over their environment. By zooming in to a micro perspective and out to a macro perspective (Nicolini, 2009) across alternative templates, the thesis sheds light on sequences, events, and actions of primary and secondary organisations. Although the primary organisation remains the focus of sustained media attention across the four-year time frame, the secondary organisations, even when one faced a similar starting situation to the primary organisation, were buffered by the process of transformative change. This understanding of crisis contexts in transforming environments builds on existing knowledge in crisis communication. At the action level, the thesis also reveals different interpretations from each alternative template. Coombs‘ (2006b) narrative shows persistence in the primary organisation‘s crisis or strategic responses over the four-year time frame of the thesis. That is, the primary organisation consistently applies a diminish crisis response. At times, the primary organisation drew on denial responses when corporate actors questioned its legitimacy or actions. To close the crisis, the primary organisation uses a rebuild crisis posture (Coombs, 2006). These finding are replicated in Allen and Caillouet‘s (1994) narrative, noting this template‘s limitation to communication messages only. Oliver‘s (1991) narrative is consistent with Coombs‘ (2006b) but also demonstrated a shift from a strategic response that signals conformity to the environment to one that signals more active resistance to the environment over time. Specifically, the primary organisation‘s initial response demonstrates conformity but these same messages were used some three years later to set new expectations in the environment in order to shape criteria and build acceptance for future organisational decisions. In summary, the findings demonstrate the power of crisis or strategic responses when considered over time and in the context of transformative change. The conclusions of this research contribute to scholarship in the public relations and management literatures. Based on the significance of organisational theory, the primary contribution of the theory relates to the role of interorganisational linkages or legitimacy buffers that form during the punctuation of equilibrium. The network of linkages among the corporate actors are significant also to the crisis communication literature as they form part of the process model of crisis communication under punctuated equilibrium. This model extends existing research that focuses on crisis communication of single organisations to consider the emergent context that incorporates secondary organisations as well as the localised contests of legitimacy and buffers from regulatory authorities. The thesis also provides an empirical base for punctuated equilibrium in public relations and crisis communication, extending Murphy‘s (2000) introduction of the theory to the public relations literature. In doing this, punctuated equilibrium theory reinvigorates theoretical development in crisis communication by extending existing scholarship around incrementalist approaches and demonstrating how public relations works in the context of transformative change. Further research in this area could consider using alternative templates to study transformative change caused by a range of crisis types from natural disasters to product tampering, and to add further insight into the dynamics between primary and secondary organisations. This thesis contributes to practice by providing guidelines for crisis response strategy selection and indicators related to the emergent context for crises under transformative change that will help primary and secondary organisations‘ responses to crises.

CAT Detect (Computer Activity Timeline Detection) : a tool for detecting inconsistency in computer activity timelines

The construction of timelines of computer activity is a part of many digital investigations. These timelines of events are composed of traces of historical activity drawn from system logs and potentially from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work introduces a software tool (CAT Detect) for the detection of inconsistency within timelines of computer activity. We examine the impact of deliberate tampering through experiments conducted with our prototype software tool. Based on the results of these experiments, we discuss techniques which can be employed to deal with such temporal inconsistencies.