By Michael P. Merritt, Assistant Director, Office of Investigations, U.S. Secret Service, Washington, D.C.
lthough the U.S. Secret Service is perhaps best known for protecting the nation’s leaders, this storied agency has long been on the forefront of the fight against cybercrime. Established in 1865 to suppress the rampant counterfeiting of U.S. currency, the Secret Service’s investigative mission has evolved, and the agency now stands as the guardian of the United States’ critical financial infrastructure. Today, the Secret Service protects U.S. consumers and the financial industry from all manners of financial and electronic crimes, including identity theft, false identification fraud, credit card fraud, debit card fraud, check fraud, bank fraud, cybercrime, and computer intrusions.
In recent years, law enforcement and consumer protection agencies have reported a marked increase in financial crimes, particularly offenses involving identity theft and access device fraud. Today’s criminals continue to seek new methods of compromising victims’ personal and financial information. The current trend observed by the law enforcement community is the use of computers and the Internet to launch cyber attacks targeting individuals and financial institutions. Cybercriminals have become adept at stealing victims’ personal information through the use of phishing e-mail, account takeovers, malicious software, hacking attacks, and network intrusions resulting in data breaches. While pursuing these cybercriminals, the Secret Service has developed particular expertise in electronic crime investigations.
Responding to the Growing Threat
To provide special agents with the advanced skills needed to investigate electronic crimes and address cyber vulnerabilities, the Secret Service established its Electronic Crimes Special Agent Program in 1987. Special agents assigned to this program complete a comprehensive training curriculum to become computer forensic specialists, qualified to conduct forensic examinations of various types of electronic evidence, including computers, telecommunications devices, electronic organizers, and other electronic media. These highly skilled agents are also trained to investigate network intrusion incidents in a rapidly evolving cybercrime environment.
In an effort to support state and local law enforcement partners and to increase the number of electronic crime investigators while advancing information sharing initiatives, the Secret Service established the Electronic Crimes State and Local Program in 2003. This program provides state and local enforcement partners with computer forensics training and hands-on experience with electronic-crimes investigations.
To expand on the successes of the Electronic Crimes State and Local Program and to continue to support state and local law enforcement officials, the Secret Service; the State of Alabama; the Alabama District Attorney’s Association; and the city of Hoover, Alabama, collaborated with the Department of Homeland Security to create a national training facility to provide training, equipment, and expertise in computer forensics and digital evidence analysis.
National Computer Forensics Institute
The National Computer Forensics Institute (NCFI), established in 2007, is a state-of-the-art facility designed to provide state and local law enforcement partners the training necessary to conduct basic electronic crimes investigations, respond to network intrusion incidents, and conduct computer forensics examinations.
The NCFI is dedicated to the education of law enforcement professionals in the field of computer forensics and digital evidence handling techniques. The facility includes five high-tech classrooms, a mock courtroom, a computer forensics laboratory, and other meeting and training areas. In August 2007, the inaugural classes of the NCFI were held, with Secret Service personnel participating as instructors and proctors. To date, over 300 people have attended training at the institute.
The NCFI offers state and local law enforcement partners, prosecutors, and judges a variety of cyber-related courses based on the Secret Service electronic crimes training model. All NCFI training courses, as well as travel, lodging, and per diem for attendees, are made available through funding from the Department of Homeland Security. Upon completion of training, attendees are issued all of the computer equipment, hardware, software, manuals, and tools necessary to conduct electronic-crimes investigations and forensic examinations.
Classes offered at the NCFI are tailored specifically to meet the unique needs of state and local law enforcement agencies, prosecutors, and judges. The NCFI curriculum currently includes the following courses:
- The Basic Investigation of Computer and Electronic Crimes Program
(BICEP) is a five-day course designed to provide investigators with the ability to act as first responders to a variety of cyber-related cases.
- The Network Intrusion Response Program (NITRO) is a 14-day course designed to provide training on effective response to network intrusion incidents, including mitigation techniques, the collection of volatile data, and the investigation of network-based crimes.
- Basic Computer Evidence Recovery Training (BCERT) is a five-week course designed to provide hands-on experience with computer hardware, device imaging solutions, and forensic analysis tools. The course also addresses legal issues and report generation requirements for cyber incident responders and digital evidence examiners.
- Advanced Computer Evidence Recovery Training (ACERT) is a five-day course designed to provide experienced forensic examiners with the knowledge and abilities to apply network- and/or server-based forensic processing skills.
- Computer Forensics in Court–Judges (CFC-J) is a four-day course designed to provide hands-on experience with computer and networking technology to allow judges to obtain knowledge and insight into presiding over criminal cases involving digital evidence.
- Computer Forensics in Court–Prosecutors (CFC-P) is a five-day course designed to provide hands-on experience with computer and networking technology to allow prosecutors to obtain knowledge and insight into handling criminal cases involving digital evidence.
New Training for New Challenges
Today’s high-tech environment presents new challenges to law enforcement agencies as cybercriminals exploit computers and the Internet to threaten banking, financial, and other critical infrastructures in the United States and worldwide. This innovative facility and strategic partnership will substantially enhance law enforcement efforts to suppress the continually evolving and increasing number of electronic crime cases affecting communities across the country. ?
|For More Information|
Personnel wishing to attend the NCFI must be nominated by the Special Agent in Charge of the Secret Service field office in their district. Readers should contact their local Secret Service field office to inquire about nomination procedures. To obtain more information about the NCFI or to view class schedules, readers can visit www.ncfi.usss.gov.